[patch 3/7] d80211: fix potential interface name overflow
From: David Kimdon <hidden>
Date: 2006-12-07 00:45:12
dev->name and ndev->name are both IFNAMSIZ in length, the ".%d" is not guarenteed to fit in ndev->name. Signed-off-by: David Kimdon <redacted> Index: wireless-dev/net/d80211/ieee80211_iface.c ===================================================================
--- wireless-dev.orig/net/d80211/ieee80211_iface.c
+++ wireless-dev/net/d80211/ieee80211_iface.c@@ -56,7 +56,8 @@ int ieee80211_if_add(struct net_device * if (strlen(name) == 0) { i = 0; do { - sprintf(ndev->name, "%s.%d", dev->name, i++); + snprintf(ndev->name, sizeof(ndev->name), "%s.%d", + dev->name, i++); tmp_dev = dev_get_by_name(ndev->name); if (!tmp_dev) break; --