dev->name and ndev->name are both IFNAMSIZ in length, the ".%d" is
not guarenteed to fit in ndev->name.

Signed-off-by: David Kimdon <david.kimdon@devicescape.com>

Index: wireless-dev/net/d80211/ieee80211_iface.c
===================================================================
--- wireless-dev.orig/net/d80211/ieee80211_iface.c
+++ wireless-dev/net/d80211/ieee80211_iface.c
@@ -56,7 +56,8 @@ int ieee80211_if_add(struct net_device *
 	if (strlen(name) == 0) {
 		i = 0;
 		do {
-			sprintf(ndev->name, "%s.%d", dev->name, i++);
+			snprintf(ndev->name, sizeof(ndev->name), "%s.%d",
+				 dev->name, i++);
 			tmp_dev = dev_get_by_name(ndev->name);
 			if (!tmp_dev)
 				break;

--
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html