staging: r8188eu: array overflow in rtw_mp_ioctl_hdl()

PATCH In review Dan Carpenter 2 participants 2 messages Feb 3, 2014 – Feb 7, 2014

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2014-02-03 22:38 UTC #0 lore raw

PATCH 1/2 staging: r8188eu: array overflow in rtw_mp_ioctl_hdl()

MAX_MP_IOCTL_SUBCODE (35) and mp_ioctl_hdl (32 elements) are no longer in sync. It leads to a bogus pointer dereference.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +1 -1

index dec992569476..684bc8107a48 100644
@@ -2500,7 +2500,7 @@ static int rtw_mp_ioctl_hdl(struct net_device *dev, struct iw_request_info *info
 		 ("rtw_mp_ioctl_hdl: subcode [%d], len[%d], buffer_len[%d]\r\n",
 		  poidparam->subcode, poidparam->len, len));
 
-	if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
+	if (poidparam->subcode >= ARRAY_SIZE(mp_ioctl_hdl)) {
 		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_, ("no matching drvext subcodes\r\n"));
 		ret = -EINVAL;
 		goto _rtw_mp_ioctl_hdl_exit;

Larry Finger

Acked-by on v1 1/2

2014-02-07 02:50 UTC #1 lore raw

Quoted 4 lines · Dan Carpenter

MAX_MP_IOCTL_SUBCODE (35) and mp_ioctl_hdl (32 elements) are no longer in sync. It leads to a bogus pointer dereference.
Signed-off-by Dan Carpenter <[email protected]>

Acked-by Larry Finger <[email protected]>

Larry

Quoted 15 lines

drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +1 -1

index dec992569476..684bc8107a48 100644
@@ -2500,7 +2500,7 @@ static int rtw_mp_ioctl_hdl(struct net_device *dev, struct iw_request_info *info
  		 ("rtw_mp_ioctl_hdl: subcode [%d], len[%d], buffer_len[%d]\r\n",
  		  poidparam->subcode, poidparam->len, len));
 
-	if (poidparam->subcode >= MAX_MP_IOCTL_SUBCODE) {
+	if (poidparam->subcode >= ARRAY_SIZE(mp_ioctl_hdl)) {
  		RT_TRACE(_module_rtl871x_ioctl_os_c, _drv_err_, ("no matching drvext subcodes\r\n"));
  		ret = -EINVAL;
  		goto _rtw_mp_ioctl_hdl_exit;