Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd0fc521 authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

mwifiex: potential corruption in mwifiex_update_uap_custom_ie() 



ap_custom_ie is a struct mwifiex_ie_list which is quite different and
also larger than struct mwifiex_ie.  It's a difference between 4196
bytes and 262.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Tested-by: default avatarStone Piao <piaoyun@marvell.com>
Acked-by: default avatarBing Zhao <bzhao@marvell.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 046b6802

drivers/net/wireless/mwifiex/ie.c

+1 −1
Original line number Diff line number Diff line
@@ -160,7 +160,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv, 
	u16 len;

	int ret;



	ap_custom_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);

	ap_custom_ie = kzalloc(sizeof(*ap_custom_ie), GFP_KERNEL);

	if (!ap_custom_ie)

		return -ENOMEM;