diff options
| author | Tillmann Heidsieck <theidsieck@leenox.de> | 2015-09-23 20:07:53 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-09-29 02:19:26 (GMT) |
| commit | 4ccb726c728cb414d9abc65a11a6453e75204503 (patch) | |
| tree | 5b10e6733279602ccfa3e6c1d8a9a670b700f26f /drivers/staging/wlan-ng | |
| parent | 174f2642349da542eb27c011e67a147773d8721f (diff) | |
| download | linux-4ccb726c728cb414d9abc65a11a6453e75204503.tar.xz | |
staging: wlan-ng fix buffer overflow in firmware handling
We test for an END marker in the element beyond the current one, this
effectively limits the size of the array to be HFA384x_PDA_LEN_MAX/2 - 1
not HFA384x_PDR_END_OF_PDA/2. This patch fixes a possible buffer
overflow in case there was no END marker.
Signed-off-by: Tillmann Heidsieck <theidsieck@leenox.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/wlan-ng')
| -rw-r--r-- | drivers/staging/wlan-ng/prism2fw.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/wlan-ng/prism2fw.c b/drivers/staging/wlan-ng/prism2fw.c index fe36613..d357b7e 100644 --- a/drivers/staging/wlan-ng/prism2fw.c +++ b/drivers/staging/wlan-ng/prism2fw.c @@ -590,7 +590,7 @@ static int mkpdrlist(struct pda *pda) pda->nrec = 0; curroff = 0; - while (curroff < (HFA384x_PDA_LEN_MAX / 2) && + while (curroff < (HFA384x_PDA_LEN_MAX / 2 - 1) && le16_to_cpu(pda16[curroff + 1]) != HFA384x_PDR_END_OF_PDA) { pda->rec[pda->nrec] = (hfa384x_pdrec_t *) &(pda16[curroff]); @@ -626,7 +626,7 @@ static int mkpdrlist(struct pda *pda) curroff += le16_to_cpu(pda16[curroff]) + 1; } - if (curroff >= (HFA384x_PDA_LEN_MAX / 2)) { + if (curroff >= (HFA384x_PDA_LEN_MAX / 2 - 1)) { pr_err("no end record found or invalid lengths in PDR data, exiting. %x %d\n", curroff, pda->nrec); return 1; |