hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

staging: ath6kl: buffer overflow in SEND_FRAME ioctl 

We should check that optTxFrmCmd.optIEDataLen isn't too large before we
copy it into the data buffer.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Vipin Mehta <vipin.mehta@atheros.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dan Carpenter 2011-02-20 15:49:53 +03:00 committed by Greg Kroah-Hartman
parent 253804a25b
commit 5b6567ee84
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/staging/ath6kl/os/linux/ioctl.c
View File

@ -3175,6 +3175,11 @@ int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
break;
}
if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) {
ret = -EINVAL;
break;
}
if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1,
optTxFrmCmd.optIEDataLen)) {
ret = -EFAULT;