leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Staging: vt6656: add some range checks before memcpy()

Browse Source 
We need to verify that we're not writing past the end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Carpenter 2011-10-20 09:10:39 +03:00 committed by Greg Kroah-Hartman
parent 883aeecc9d
commit 44ec5d2916
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/staging/vt6656/ioctl.c
View File

@ -81,6 +81,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
return -EINVAL;
if (pItemSSID->len != 0) {
memset(abyScanSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(abyScanSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
@ -155,6 +157,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);
if (sJoinCmd.wBSSType == ADHOC) {
@ -476,6 +480,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
}
pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
return -EINVAL;
memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + WLAN_SSID_MAXLEN + 1);
memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + WLAN_IEHDR_LEN);