mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-04 00:06:36 +00:00
staging: wilc1000: potential corruption in wilc_parse_join_bss_param()
The "rates_len" value needs to be capped so that the memcpy() doesn't
copy beyond the end of the array.
Fixes: c5c77ba18e
("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Adham Abozaeid <adham.abozaeid@microchip.com>
Link: https://lore.kernel.org/r/20191017091832.GB31278@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
bfc0a0935a
commit
d59dc92f1b
1 changed files with 2 additions and 0 deletions
|
@ -479,6 +479,8 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
|
|||
rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len);
|
||||
if (rates_ie) {
|
||||
rates_len = rates_ie[1];
|
||||
if (rates_len > WILC_MAX_RATES_SUPPORTED)
|
||||
rates_len = WILC_MAX_RATES_SUPPORTED;
|
||||
param->supp_rates[0] = rates_len;
|
||||
memcpy(¶m->supp_rates[1], rates_ie + 2, rates_len);
|
||||
}
|
||||
|
|
Loading…
Add table
Reference in a new issue