openwrt/target/linux/package/madwifi/patches/103-wpa_crash.patch

   1 diff -ru madwifi-ng-r1451-20060212/net80211/ieee80211_ioctl.h madwifi-ng-r1451-20060212-patch/net80211/ieee80211_ioctl.h
   2 --- madwifi-ng-r1451-20060212/net80211/ieee80211_ioctl.h        2006-02-06 11:03:21.000000000 -0500
   3 +++ madwifi-ng-r1451-20060212-patch/net80211/ieee80211_ioctl.h  2006-02-16 06:05:22.000000000 -0500
   4 @@ -280,6 +280,7 @@
   5  struct ieee80211req_wpaie {
   6         u_int8_t        wpa_macaddr[IEEE80211_ADDR_LEN];
   7         u_int8_t        wpa_ie[IEEE80211_MAX_OPT_IE];
   8 +       u_int8_t        rsn_ie[IEEE80211_MAX_OPT_IE];
   9  };
  10
  11  /*
  12 diff -ru madwifi-ng-r1451-20060212/net80211/ieee80211_wireless.c madwifi-ng-r1451-20060212-patch/net80211/ieee80211_wireless.c
  13 --- madwifi-ng-r1451-20060212/net80211/ieee80211_wireless.c     2006-02-06 12:39:10.000000000 -0500
  14 +++ madwifi-ng-r1451-20060212-patch/net80211/ieee80211_wireless.c       2006-02-16 06:05:22.000000000 -0500
  15 @@ -3231,6 +3231,12 @@
  16                         ielen = sizeof(wpaie.wpa_ie);
  17                 memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
  18         }
  19 +       if (ni->ni_rsn_ie != NULL) {
  20 +               int ielen = ni->ni_rsn_ie[1] + 2;
  21 +               if (ielen > sizeof(wpaie.rsn_ie))
  22 +                       ielen = sizeof(wpaie.rsn_ie);
  23 +               memcpy(wpaie.rsn_ie, ni->ni_rsn_ie, ielen);
  24 +       }
  25         ieee80211_free_node(ni);
  26         return (copy_to_user(iwr->u.data.pointer, &wpaie, sizeof(wpaie)) ?
  27                 -EFAULT : 0);