Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed87c2b2 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: vt6655: buffer overflow in ioctl 



->u.generic_elem.len is a user controlled number between 0-255.  We
should limit it to avoid memory corruption.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 922b83b4

drivers/staging/vt6655/hostap.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice, 
{

{

	PSMgmtObject    pMgmt = pDevice->pMgmt;

	PSMgmtObject    pMgmt = pDevice->pMgmt;





	if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))

		return -EINVAL;



	memcpy(pMgmt->abyWPAIE,

	memcpy(pMgmt->abyWPAIE,

	       param->u.generic_elem.data,

	       param->u.generic_elem.data,

	       param->u.generic_elem.len

	       param->u.generic_elem.len