* [patch 2/2] Staging: vt6656: add some range checks before memcpy()
@ 2011-10-20 6:10 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2011-10-20 6:10 UTC (permalink / raw)
To: kernel-janitors
We need to verify that we're not writing past the end of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/vt6656/ioctl.c b/drivers/staging/vt6656/ioctl.c
index 2cde4f0c..4939002 100644
--- a/drivers/staging/vt6656/ioctl.c
+++ b/drivers/staging/vt6656/ioctl.c
@@ -81,6 +81,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
if (pItemSSID->len != 0) {
memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
@@ -155,6 +157,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
if (sJoinCmd.wBSSType = ADHOC) {
@@ -476,6 +480,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-10-20 6:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-10-20 6:10 [patch 2/2] Staging: vt6656: add some range checks before memcpy() Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox