leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

staging: rtl8723au: Another case of missing 'tid' bounds checking.

Browse Source 
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jes Sorensen 2014-05-09 15:04:17 +02:00 committed by Greg Kroah-Hartman
parent 4e489d91b4
commit d7f2c23adf
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/staging/rtl8723au/core/rtw_cmd.c
View File

@ -823,6 +823,11 @@ u8 rtw_addbareq_cmd23a(struct rtw_adapter*padapter, u8 tid, u8 *addr)
struct addBaReq_parm *paddbareq_parm;
u8 res = _SUCCESS;
if (tid >= MAXTID) {
res = _FAIL;
goto exit;
}
ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
if (!ph2c) {
res = _FAIL;

2
drivers/staging/rtl8723au/core/rtw_mlme_ext.c
View File

@ -6354,7 +6354,7 @@ u8 add_ba_hdl23a(struct rtw_adapter *padapter, const u8 *pbuf)
mod_timer(&psta->addba_retry_timer,
jiffies + msecs_to_jiffies(ADDBA_TO));
} else {
psta->htpriv.candidate_tid_bitmap &= ~CHKBIT(pparm->tid);
psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
}
return H2C_SUCCESS;
}