From: Jianjun Kong <jianjun@zeuux.org>
Date: Tue, 11 Nov 2008 05:37:39 +0000 (-0800)
Subject: mac80211: fix a buffer overrun in station debug code
X-Git-Tag: v2.6.28-rc5~90^2~4
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=013cd397532e5803a1625954a884d021653da720;p=linux-2.6-omap-h63xx.git

mac80211: fix a buffer overrun in station debug code

net/mac80211/debugfs_sta.c
The trailing zero was written to state[4], it's out of bounds.

Signed-off-by: Jianjun Kong <jianjun@zeuux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 189d0bafa91..b85c4f27b36 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -199,7 +199,7 @@ static ssize_t sta_agg_status_write(struct file *file,
 		/* toggle Rx aggregation command */
 		tid_num = tid_num - 100;
 		if (tid_static_rx[tid_num] == 1) {
-			strcpy(state, "off ");
+			strcpy(state, "off");
 			ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
 					WLAN_REASON_QSTA_REQUIRE_SETUP);
 			sta->ampdu_mlme.tid_state_rx[tid_num] |=