summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/intel/ipw2x00
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2021-04-14 11:29:55 +0300
committerKalle Valo <kvalo@codeaurora.org>2021-04-17 20:35:44 +0300
commit260a9ad9446723d4063ed802989758852809714d (patch)
treec0dbe4497193fad4013e29fcf50b1b7421763b56 /drivers/net/wireless/intel/ipw2x00
parente9642be26a372013e47801e1dd98e8f4dcf78f50 (diff)
downloadlinux-260a9ad9446723d4063ed802989758852809714d.tar.xz
ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
The "ext->key_len" is a u16 that comes from the user. If it's over SCM_KEY_LEN (32) that could lead to memory corruption. Fixes: e0d369d1d969 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
Diffstat (limited to 'drivers/net/wireless/intel/ipw2x00')
-rw-r--r--drivers/net/wireless/intel/ipw2x00/libipw_wx.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
index a0cf78c418ac..903de34028ef 100644
--- a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
+++ b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c
@@ -633,8 +633,10 @@ int libipw_wx_set_encodeext(struct libipw_device *ieee,
}
if (ext->alg != IW_ENCODE_ALG_NONE) {
- memcpy(sec.keys[idx], ext->key, ext->key_len);
- sec.key_sizes[idx] = ext->key_len;
+ int key_len = clamp_val(ext->key_len, 0, SCM_KEY_LEN);
+
+ memcpy(sec.keys[idx], ext->key, key_len);
+ sec.key_sizes[idx] = key_len;
sec.flags |= (1 << idx);
if (ext->alg == IW_ENCODE_ALG_WEP) {
sec.encode_alg[idx] = SEC_ALG_WEP;