leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

staging: vt6655: buffer overflow in ioctl

Browse Source 
->u.generic_elem.len is a user controlled number between 0-255.  We
should limit it to avoid memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2014-09-19 13:43:11 +03:00 committed by Greg Kroah-Hartman
parent 922b83b4aa
commit ed87c2b2e7
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/staging/vt6655/hostap.c
View File

@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice,
{
PSMgmtObject pMgmt = pDevice->pMgmt;
if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))
return -EINVAL;
memcpy(pMgmt->abyWPAIE,
param->u.generic_elem.data,
param->u.generic_elem.len