From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752247AbbCTOVx (ORCPT ); Fri, 20 Mar 2015 10:21:53 -0400 Received: from mail-we0-f182.google.com ([74.125.82.182]:33039 "EHLO mail-we0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752091AbbCTOVs (ORCPT ); Fri, 20 Mar 2015 10:21:48 -0400 From: Matteo Semenzato X-Google-Original-From: Matteo Semenzato To: gregkh@linuxfoundation.org, navin.patidar@gmail.com, hejianet@gmail.com, sudipm.mukherjee@gmail.com Cc: devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, Matteo Semenzato Subject: [PATCH] Staging: rtl8188eu fix buffer overflow Date: Fri, 20 Mar 2015 15:21:40 +0100 Message-Id: <1426861300-13286-1-git-send-email-mattew8898@gmail.com> X-Mailer: git-send-email 2.3.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Matteo Semenzato This patch fixes the buffer overflow caused by accessing index 4 of hwxmits. Signed-off-by: Matteo Semenzato --- drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c index 7a71df1..7b22779 100644 --- a/drivers/staging/rtl8188eu/core/rtw_xmit.c +++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c @@ -1631,10 +1631,12 @@ void rtw_alloc_hwxmits(struct adapter *padapter) { struct hw_xmit *hwxmits; struct xmit_priv *pxmitpriv = &padapter->xmitpriv; + size_t size; pxmitpriv->hwxmit_entry = HWXMIT_ENTRY; - pxmitpriv->hwxmits = kzalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry, GFP_KERNEL); + size = sizeof(struct hw_xmit) * (pxmitpriv->hwxmit_entry + 1); + pxmitpriv->hwxmits = kzalloc(size, GFP_KERNEL); hwxmits = pxmitpriv->hwxmits; -- 2.3.2