forked from Minki/linux
2a58b19fd9
There are two potential integer overflows in private_ioctl() if userspace passes in a large sList.uItem / sNodeList.uItem. The subsequent call to kmalloc() would allocate a small buffer, leading to a memory corruption. Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Xi Wang <xi.wang@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
||
---|---|---|
.. | ||
80211hdr.h | ||
80211mgr.c | ||
80211mgr.h | ||
aes_ccmp.c | ||
aes_ccmp.h | ||
baseband.c | ||
baseband.h | ||
bssdb.c | ||
bssdb.h | ||
card.c | ||
card.h | ||
channel.c | ||
channel.h | ||
country.h | ||
datarate.c | ||
datarate.h | ||
desc.h | ||
device_cfg.h | ||
device_main.c | ||
device.h | ||
dpc.c | ||
dpc.h | ||
hostap.c | ||
hostap.h | ||
IEEE11h.c | ||
IEEE11h.h | ||
iocmd.h | ||
ioctl.c | ||
ioctl.h | ||
iowpa.h | ||
iwctl.c | ||
iwctl.h | ||
Kconfig | ||
key.c | ||
key.h | ||
mac.c | ||
mac.h | ||
Makefile | ||
mib.c | ||
mib.h | ||
michael.c | ||
michael.h | ||
power.c | ||
power.h | ||
rc4.c | ||
rc4.h | ||
rf.c | ||
rf.h | ||
rxtx.c | ||
rxtx.h | ||
srom.c | ||
srom.h | ||
tcrc.c | ||
tcrc.h | ||
test | ||
tether.c | ||
tether.h | ||
tkip.c | ||
tkip.h | ||
tmacro.h | ||
TODO | ||
ttype.h | ||
upc.h | ||
vntconfiguration.dat | ||
vntwifi.c | ||
vntwifi.h | ||
wcmd.c | ||
wcmd.h | ||
wctl.c | ||
wctl.h | ||
wmgr.c | ||
wmgr.h | ||
wpa2.c | ||
wpa2.h | ||
wpa.c | ||
wpa.h | ||
wpactl.c | ||
wpactl.h | ||
wroute.c | ||
wroute.h |