summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2011-10-20 06:10:09 (GMT)
committerGreg Kroah-Hartman <gregkh@suse.de>2011-10-23 08:13:20 (GMT)
commit0c849b3c16f4dab5848182868094adeb51210d8b (patch)
treecdb75bf3e8d7971c5ad592be4c28d8d5f39a6329
parent0d3eb2b29f116a2be4e042cbab0e14c9957cc8e2 (diff)
downloadlinux-fsl-qoriq-0c849b3c16f4dab5848182868094adeb51210d8b.tar.xz
Staging: vt6655: add some range checks before memcpy()
There were no range checks in the original code so the user could write past the end of the array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/staging/vt6655/ioctl.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/vt6655/ioctl.c b/drivers/staging/vt6655/ioctl.c
index 6718cfd..432a209 100644
--- a/drivers/staging/vt6655/ioctl.c
+++ b/drivers/staging/vt6655/ioctl.c
@@ -82,6 +82,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
if (pItemSSID->len != 0) {
memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
@@ -168,6 +170,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
if (sJoinCmd.wBSSType == ADHOC) {
@@ -490,6 +494,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
+ if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+ return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);