public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/drivers/net/wireless/intel/ipw2x00
History
Dan Carpenter 260a9ad944 ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() 
The "ext->key_len" is a u16 that comes from the user.  If it's over
SCM_KEY_LEN (32) that could lead to memory corruption.

Fixes: e0d369d1d9 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
2021-04-17 20:35:44 +03:00
..
ipw.h
ipw2100.c net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros 2020-09-29 14:02:55 -07:00
ipw2100.h
ipw2200.c
ipw2200.h net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros 2020-09-29 14:02:55 -07:00
Kconfig
libipw.h net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros 2020-09-29 14:02:55 -07:00
libipw_geo.c
libipw_module.c
libipw_rx.c
libipw_tx.c
libipw_wx.c ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() 2021-04-17 20:35:44 +03:00
Makefile