* [patch 2/2] Staging: vt6655: add some range checks before memcpy()
@ 2011-10-20 6:10 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2011-10-20 6:10 UTC (permalink / raw)
To: kernel-janitors
There were no range checks in the original code so the user could
write past the end of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/vt6655/ioctl.c b/drivers/staging/vt6655/ioctl.c
index 6718cfd..432a209 100644
--- a/drivers/staging/vt6655/ioctl.c
+++ b/drivers/staging/vt6655/ioctl.c
@@ -82,6 +82,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
if (pItemSSID->len != 0) {
memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
@@ -168,6 +170,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
if (sJoinCmd.wBSSType = ADHOC) {
@@ -490,6 +494,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-10-20 6:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-20 6:10 [patch 2/2] Staging: vt6655: add some range checks before memcpy() Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.