Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00ad0311 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

wifi: libertas: cap SSID len in lbs_associate() 



[ Upstream commit c786794bd27b0d7a5fd9063695df83206009be59 ]

If the ssid_eid[1] length is more that 32 it leads to memory corruption.

Fixes: a910e4a9 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/2a40f5ec7617144aef412034c12919a4927d90ad.1756456951.git.dan.carpenter@linaro.org


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 6381da82

drivers/net/wireless/marvell/libertas/cfg.c

+6 −3
Original line number Diff line number Diff line
@@ -1102,10 +1102,13 @@ static int lbs_associate(struct lbs_private *priv, 
	/* add SSID TLV */

	rcu_read_lock();

	ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);

	if (ssid_eid)

		pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);

	else

	if (ssid_eid) {

		u32 ssid_len = min(ssid_eid[1], IEEE80211_MAX_SSID_LEN);



		pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_len);

	} else {

		lbs_deb_assoc("no SSID\n");

	}

	rcu_read_unlock();



	/* add DS param TLV */