Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b6567ee authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: ath6kl: buffer overflow in SEND_FRAME ioctl 



We should check that optTxFrmCmd.optIEDataLen isn't too large before we
copy it into the data buffer.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarVipin Mehta <vipin.mehta@atheros.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 253804a2

drivers/staging/ath6kl/os/linux/ioctl.c

+5 −0
Original line number Diff line number Diff line
@@ -3175,6 +3175,11 @@ int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) 
                break;

            }



            if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) {

                ret = -EINVAL;

                break;

            }



            if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1,

                                   optTxFrmCmd.optIEDataLen)) {

                ret = -EFAULT;