diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2011-10-20 09:10:09 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2011-10-23 10:13:20 +0200 |
| commit | 0c849b3c16f4dab5848182868094adeb51210d8b (patch) | |
| tree | cdb75bf3e8d7971c5ad592be4c28d8d5f39a6329 /drivers/staging/vt6655/ioctl.c | |
| parent | Staging: vt6655: whitespace fixes to iotcl.c (diff) | |
| download | linux-dev-0c849b3c16f4dab5848182868094adeb51210d8b.tar.xz linux-dev-0c849b3c16f4dab5848182868094adeb51210d8b.zip | |
Staging: vt6655: add some range checks before memcpy()
There were no range checks in the original code so the user could
write past the end of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/vt6655/ioctl.c')
| -rw-r--r-- | drivers/staging/vt6655/ioctl.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/vt6655/ioctl.c b/drivers/staging/vt6655/ioctl.c index 6718cfdd7756..432a20993c6e 100644 --- a/drivers/staging/vt6655/ioctl.c +++ b/drivers/staging/vt6655/ioctl.c @@ -82,6 +82,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) } pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid; + if (pItemSSID->len > WLAN_SSID_MAXLEN + 1) + return -EINVAL; if (pItemSSID->len != 0) { memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1); memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN); @@ -168,6 +170,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) } pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid; + if (pItemSSID->len > WLAN_SSID_MAXLEN + 1) + return -EINVAL; memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1); memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN); if (sJoinCmd.wBSSType == ADHOC) { @@ -490,6 +494,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) } pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid; + if (pItemSSID->len > WLAN_SSID_MAXLEN + 1) + return -EINVAL; memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1); memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN); |