Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ccb726c authored by Tillmann Heidsieck's avatar Tillmann Heidsieck Committed by Greg Kroah-Hartman
Browse files

staging: wlan-ng fix buffer overflow in firmware handling 



We test for an END marker in the element beyond the current one, this
effectively limits the size of the array to be HFA384x_PDA_LEN_MAX/2 - 1
not HFA384x_PDR_END_OF_PDA/2. This patch fixes a possible buffer
overflow in case there was no END marker.

Signed-off-by: default avatarTillmann Heidsieck <theidsieck@leenox.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 174f2642

drivers/staging/wlan-ng/prism2fw.c

+2 −2
Original line number Diff line number Diff line
@@ -590,7 +590,7 @@ static int mkpdrlist(struct pda *pda) 


	pda->nrec = 0;

	curroff = 0;

	while (curroff < (HFA384x_PDA_LEN_MAX / 2) &&

	while (curroff < (HFA384x_PDA_LEN_MAX / 2 - 1) &&

	       le16_to_cpu(pda16[curroff + 1]) != HFA384x_PDR_END_OF_PDA) {

		pda->rec[pda->nrec] = (hfa384x_pdrec_t *) &(pda16[curroff]);
@@ -626,7 +626,7 @@ static int mkpdrlist(struct pda *pda) 
		curroff += le16_to_cpu(pda16[curroff]) + 1;



	}

	if (curroff >= (HFA384x_PDA_LEN_MAX / 2)) {

	if (curroff >= (HFA384x_PDA_LEN_MAX / 2 - 1)) {

		pr_err("no end record found or invalid lengths in PDR data, exiting. %x %d\n",

		       curroff, pda->nrec);

		return 1;