staging: vt6655: buffer overflow in ioctl

PATCH New Dan Carpenter 1 participant 1 message Sep 19, 2014

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2014-09-19 10:43 UTC #0 lore raw

PATCH 1/2 staging: vt6655: buffer overflow in ioctl

->u.generic_elem.len is a user controlled number between 0-255. We should limit it to avoid memory corruption.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/vt6655/hostap.c +3 -0

index 0dd87d4..73429f4 100644
@@ -341,6 +341,9 @@ static int hostap_set_generic_element(struct vnt_private *pDevice,
 {
 	PSMgmtObject    pMgmt = pDevice->pMgmt;
 
+	if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))
+		return -EINVAL;
+
 	memcpy(pMgmt->abyWPAIE,
 	       param->u.generic_elem.data,
 	       param->u.generic_elem.len