Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 300cd664 authored by Young Xiao's avatar Young Xiao Committed by Greg Kroah-Hartman
Browse files

staging: rtl8712: Fix possible buffer overrun 



In commit 8b7a13c3 ("staging: r8712u: Fix possible buffer
overrun") we fix a potential off by one by making the limit smaller.
The better fix is to make the buffer larger.  This makes it match up
with the similar code in other drivers.

Fixes: 8b7a13c3 ("staging: r8712u: Fix possible buffer overrun")
Signed-off-by: default avatarYoung Xiao <YangX92@hotmail.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 25956467

drivers/staging/rtl8712/mlme_linux.c

+1 −1
Original line number Diff line number Diff line
@@ -146,7 +146,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie) 
		p = buff;

		p += sprintf(p, "ASSOCINFO(ReqIEs=");

		len = sec_ie[1] + 2;

		len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;

		len =  (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;

		for (i = 0; i < len; i++)

			p += sprintf(p, "%02x", sec_ie[i]);

		p += sprintf(p, ")");

drivers/staging/rtl8712/rtl871x_mlme.c

+1 −1
Original line number Diff line number Diff line
@@ -1346,7 +1346,7 @@ sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie, 
		     u8 *out_ie, uint in_len)

{

	u8 authmode = 0, match;

	u8 sec_ie[255], uncst_oui[4], bkup_ie[255];

	u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];

	u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};

	uint ielength, cnt, remove_cnt;

	int iEntry;