diff options
| author |   Murray McAllister <murray.mcallister@insomniasec.com> | 2018-07-02 13:07:28 +1200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-07-02 10:45:39 +0200 |
| commit | 920c92448839bd4f8eb87a92b08cad56d449caff (patch) | |
| tree | 9345c9fa84eb0ddeb8abdbfd8095c6d743947304 /drivers/staging/rtl8723bs | |
| parent | Linux 4.18-rc3 (diff) | |
| download | linux-dev-920c92448839bd4f8eb87a92b08cad56d449caff.tar.xz linux-dev-920c92448839bd4f8eb87a92b08cad56d449caff.zip | |
staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
Dan Carpenter reported an integer underflow issue in the rtl8188eu driver.
This is also needed for the length (signed integer) in rtl8723bs, as it is
later converted to an unsigned integer and used in a memcpy operation.
Original issue is at https://patchwork.kernel.org/patch/9796371/
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/rtl8723bs')
| -rw-r--r-- | drivers/staging/rtl8723bs/core/rtw_ap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c index 45c05527a57a..faf4b4158cfa 100644 --- a/drivers/staging/rtl8723bs/core/rtw_ap.c +++ b/drivers/staging/rtl8723bs/core/rtw_ap.c @@ -1051,7 +1051,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) return _FAIL; - if (len > MAX_IE_SZ) + if (len < 0 || len > MAX_IE_SZ) return _FAIL; pbss_network->IELength = len; |