Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0c849b3c authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: vt6655: add some range checks before memcpy() 



There were no range checks in the original code so the user could
write past the end of the array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 0d3eb2b2

drivers/staging/vt6655/ioctl.c

+6 −0
Original line number Diff line number Diff line
@@ -82,6 +82,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) 
		}



		pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;

		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)

			return -EINVAL;

		if (pItemSSID->len != 0) {

			memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);

			memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
@@ -168,6 +170,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) 
		}



		pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;

		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)

			return -EINVAL;

		memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);

		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);

		if (sJoinCmd.wBSSType == ADHOC) {
@@ -490,6 +494,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) 
		}



		pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;

		if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)

			return -EINVAL;

		memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);

		memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);