staging: r8712u: Fix possible out-of-bounds index with TKIP and AES keys
Array XGrpKey has only 2 elements and uses (keyid - 1) as the index, which allows the possibility of memory corruption from an out-of-bounds index. This problem was reported by a new version of smatch. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
8550be08cb
commit
447ff88652
|
@ -1281,12 +1281,16 @@ sint r8712_set_key(struct _adapter *adapter,
|
||||||
psecuritypriv->DefKey[keyid].skey, keylen);
|
psecuritypriv->DefKey[keyid].skey, keylen);
|
||||||
break;
|
break;
|
||||||
case _TKIP_:
|
case _TKIP_:
|
||||||
|
if (keyid < 1 || keyid > 2)
|
||||||
|
return _FAIL;
|
||||||
keylen = 16;
|
keylen = 16;
|
||||||
memcpy(psetkeyparm->key,
|
memcpy(psetkeyparm->key,
|
||||||
&psecuritypriv->XGrpKey[keyid - 1], keylen);
|
&psecuritypriv->XGrpKey[keyid - 1], keylen);
|
||||||
psetkeyparm->grpkey = 1;
|
psetkeyparm->grpkey = 1;
|
||||||
break;
|
break;
|
||||||
case _AES_:
|
case _AES_:
|
||||||
|
if (keyid < 1 || keyid > 2)
|
||||||
|
return _FAIL;
|
||||||
keylen = 16;
|
keylen = 16;
|
||||||
memcpy(psetkeyparm->key,
|
memcpy(psetkeyparm->key,
|
||||||
&psecuritypriv->XGrpKey[keyid - 1], keylen);
|
&psecuritypriv->XGrpKey[keyid - 1], keylen);
|
||||||
|
|
Loading…
Reference in New Issue