* [patch 1/2] Staging: rtl8192e: array overflow in rtl92e_set_swcam()
@ 2015-07-28 15:48 Dan Carpenter
2015-07-28 18:17 ` Mateusz Kulikowski
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2015-07-28 15:48 UTC (permalink / raw)
To: kernel-janitors
"EntryNo" is comes from the user in the ioctl and it's a number between
0-255. The ieee->swcamtable[] array only has 32 elements so it can
result in memory corruption.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
index dc8c7a8..c146b7e 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
RT_TRACE(COMP_DBG,
"======>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
__func__, EntryNo, KeyIndex, KeyType, is_mesh);
+
+ if (EntryNo >= TOTAL_CAM_ENTRY)
+ return;
+
if (!is_mesh) {
ieee->swcamtable[EntryNo].bused = true;
ieee->swcamtable[EntryNo].key_index = KeyIndex;
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch 1/2] Staging: rtl8192e: array overflow in rtl92e_set_swcam()
2015-07-28 15:48 [patch 1/2] Staging: rtl8192e: array overflow in rtl92e_set_swcam() Dan Carpenter
@ 2015-07-28 18:17 ` Mateusz Kulikowski
0 siblings, 0 replies; 2+ messages in thread
From: Mateusz Kulikowski @ 2015-07-28 18:17 UTC (permalink / raw)
To: kernel-janitors
On 28.07.2015 17:48, Dan Carpenter wrote:
> "EntryNo" is comes from the user in the ioctl and it's a number between
> 0-255. The ieee->swcamtable[] array only has 32 elements so it can
> result in memory corruption.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
> index dc8c7a8..c146b7e 100644
> --- a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
> +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
> @@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
> RT_TRACE(COMP_DBG,
> "======>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
> __func__, EntryNo, KeyIndex, KeyType, is_mesh);
> +
> + if (EntryNo >= TOTAL_CAM_ENTRY)
> + return;
> +
> if (!is_mesh) {
> ieee->swcamtable[EntryNo].bused = true;
> ieee->swcamtable[EntryNo].key_index = KeyIndex;
>
+1 for both patches - thanks for finding this.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-07-28 18:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-07-28 15:48 [patch 1/2] Staging: rtl8192e: array overflow in rtl92e_set_swcam() Dan Carpenter
2015-07-28 18:17 ` Mateusz Kulikowski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.