leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
dd85fc0ab5
linux/drivers/net/wireless/intel/ipw2x00
History
Dan Carpenter 260a9ad944 ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() 
The "ext->key_len" is a u16 that comes from the user.  If it's over
SCM_KEY_LEN (32) that could lead to memory corruption.

Fixes: e0d369d1d9 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
2021-04-17 20:35:44 +03:00
..
ipw2100.c net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros 2020-09-29 14:02:55 -07:00
ipw2100.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 507 2019-06-19 17:11:23 +02:00
ipw2200.c ipw2x00: convert tasklets to use new tasklet_setup() API 2020-08-27 16:22:06 +03:00
ipw2200.h net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros 2020-09-29 14:02:55 -07:00
ipw.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Kconfig net: wireless: drop bogus CRYPTO_xxx Kconfig selects 2020-09-11 14:39:16 +10:00
libipw_geo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 507 2019-06-19 17:11:23 +02:00
libipw_module.c proc: convert everything to "struct proc_ops" 2020-02-04 03:05:26 +00:00
libipw_rx.c ipw2x00: Use scnprintf() for avoiding potential buffer overflow 2020-03-12 15:43:40 +02:00
libipw_tx.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 507 2019-06-19 17:11:23 +02:00
libipw_wx.c ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() 2021-04-17 20:35:44 +03:00
libipw.h net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros 2020-09-29 14:02:55 -07:00
Makefile