hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

airo: Buffer overflow 

SSID_rid has space for only 3 ssids.
txPowerLevels[i] is read before the bounds check for i

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Roel Kluin 2009-07-25 23:02:32 +02:00 committed by John W. Linville
parent 2a21f86917
commit 3d0ccd021b
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/airo.c
View File

@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
readSsidRid(local, &SSID_rid);
/* Check if we asked for `any' */
if(dwrq->flags == 0) {
if (dwrq->flags == 0) {
/* Just send an empty SSID list */
memset(&SSID_rid, 0, sizeof(SSID_rid));
} else {
int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
/* Check the size of the string */
if(dwrq->length > IW_ESSID_MAX_SIZE) {
if (dwrq->length > IW_ESSID_MAX_SIZE)
return -E2BIG ;
}
/* Check if index is valid */
if((index < 0) || (index >= 4)) {
if (index >= ARRAY_SIZE(SSID_rid.ssids))
return -EINVAL;
}
/* Set the SSID */
memset(SSID_rid.ssids[index].ssid, 0,
@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
return -EINVAL;
}
clear_bit (FLAG_RADIO_OFF, &local->flags);
for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
if (v == cap_rid.txPowerLevels[i]) {
readConfigRid(local, 1);
local->config.txPower = v;