staging: wlags49_h2: buffer overflow setting station name

We need to check the length parameter before doing the memcpy().  I've
actually changed it to strlcpy() as well so that it's NUL terminated.

You need CAP_NET_ADMIN to trigger these so it's not the end of the
world.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
int cfg_driver_info(struct uilreq *urq, struct wl_private *lp)
{
	int result = 0;
	/*------------------------------------------------------------------------*/


	DBG_FUNC("cfg_driver_info");
	DBG_ENTER(DbgInfo);


	/* Make sure that user buffer can handle the driver information buffer */
	if (urq->len < sizeof(lp->driverInfo)) {
		urq->len = sizeof(lp->driverInfo);
		urq->result = UIL_ERR_LEN;
		DBG_LEAVE(DbgInfo);
		return result;
	}

	/* Verify the user buffer. */
	result = verify_area(VERIFY_WRITE, urq->data, sizeof(lp->driverInfo));
	if (result != 0) {
		urq->result = UIL_FAILURE;
		DBG_LEAVE(DbgInfo);
		return result;
	}

	lp->driverInfo.card_stat = lp->hcfCtx.IFB_CardStat;

	/* Copy the driver information into the user's buffer. */
	urq->result = UIL_SUCCESS;
	copy_to_user(urq->data, &(lp->driverInfo), sizeof(lp->driverInfo));

	DBG_LEAVE(DbgInfo);
	return result;
} /* cfg_driver_info */

int cfg_driver_info(struct uilreq *urq, struct wl_private *lp)
{
	int result = 0;
	/*------------------------------------------------------------------------*/


	DBG_FUNC("cfg_driver_info");
	DBG_ENTER(DbgInfo);


	/* Make sure that user buffer can handle the driver information buffer */
	if (urq->len < sizeof(lp->driverInfo)) {
		urq->len = sizeof(lp->driverInfo);
		urq->result = UIL_ERR_LEN;
		DBG_LEAVE(DbgInfo);
		return result;
	}

	/* Verify the user buffer. */
	result = verify_area(VERIFY_WRITE, urq->data, sizeof(lp->driverInfo));
	if (result != 0) {
		urq->result = UIL_FAILURE;
		DBG_LEAVE(DbgInfo);
		return result;
	}

	lp->driverInfo.card_stat = lp->hcfCtx.IFB_CardStat;

	/* Copy the driver information into the user's buffer. */
	urq->result = UIL_SUCCESS;
	copy_to_user(urq->data, &(lp->driverInfo), sizeof(lp->driverInfo));

	DBG_LEAVE(DbgInfo);
	return result;
} /* cfg_driver_info */
