diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-09-19 14:43:11 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-09-20 02:32:20 +0400 |
| commit | ed87c2b2e7dd34016017af183b8f3fbe28179bc1 (patch) | |
| tree | fc75ae737183ec9db5ee54ccaff24137661e0592 /drivers | |
| parent | 922b83b4aaae5d6071a1ede88c04bfa834fa5119 (diff) | |
| download | linux-ed87c2b2e7dd34016017af183b8f3fbe28179bc1.tar.xz | |
staging: vt6655: buffer overflow in ioctl
->u.generic_elem.len is a user controlled number between 0-255. We
should limit it to avoid memory corruption.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/staging/vt6655/hostap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c index f105c2ac091b..164136b07a68 100644 --- a/drivers/staging/vt6655/hostap.c +++ b/drivers/staging/vt6655/hostap.c @@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice, { PSMgmtObject pMgmt = pDevice->pMgmt; + if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE)) + return -EINVAL; + memcpy(pMgmt->abyWPAIE, param->u.generic_elem.data, param->u.generic_elem.len |