Commit 657d1b0d authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: vt6656: potential memory corruption 



param->u.wpa_key.key_len comes from the user.  If it's too large we
would write past the end of the array.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 6835cb6b

drivers/staging/vt6656/wpactl.c

+15 −3
Original line number Diff line number Diff line
@@ -229,6 +229,9 @@ int wpa_set_wpadev(PSDevice pDevice, int val) 
        return ret;

    }



	if (param->u.wpa_key.key && param->u.wpa_key.key_len > sizeof(abyKey))

		return -EINVAL;



    spin_unlock_irq(&pDevice->lock);

    if(param->u.wpa_key.key && fcpfkernel) {

       memcpy(&abyKey[0], param->u.wpa_key.key, param->u.wpa_key.key_len);
@@ -269,6 +272,10 @@ int wpa_set_wpadev(PSDevice pDevice, int val) 
        return ret;

	}





	if (param->u.wpa_key.seq && param->u.wpa_key.seq_len > sizeof(abySeq))

		return -EINVAL;



    spin_unlock_irq(&pDevice->lock);

        if(param->u.wpa_key.seq && fcpfkernel) {

           memcpy(&abySeq[0], param->u.wpa_key.seq, param->u.wpa_key.seq_len);
@@ -772,10 +779,15 @@ static int wpa_set_associate(PSDevice pDevice, 
    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);

    DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "Roaming dBm = %d\n", param->u.wpa_associate.roam_dbm);  //Davidwang



	if (param->u.wpa_associate.wpa_ie &&

	    copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))

	if (param->u.wpa_associate.wpa_ie) {

		if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))

			return -EINVAL;



		if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie,

					param->u.wpa_associate.wpa_ie_len))

			return -EFAULT;

	}



	if (param->u.wpa_associate.mode == 1)

	    pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;

	else

CRA Git | Maintained and supported by SUSTech CRA and CCSE