Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6b7200fe authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: vt6655: memory corruption in check in wpa_set_wpadev() 



The original code left it up to the user to decide how much data to
copy, but that doesn't work with a fixed size array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 45357433

drivers/staging/vt6655/wpactl.c

+3 −1
Original line number Diff line number Diff line
@@ -213,7 +213,9 @@ int wpa_set_wpadev(PSDevice pDevice, int val) 
	int uu, ii;





	if (param->u.wpa_key.alg_name > WPA_ALG_CCMP)

	if (param->u.wpa_key.alg_name > WPA_ALG_CCMP ||

			param->u.wpa_key.key_len >= MAX_KEY_LEN ||

			param->u.wpa_key.seq_len >= MAX_KEY_LEN)

		return -EINVAL;



    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "param->u.wpa_key.alg_name = %d \n", param->u.wpa_key.alg_name);