Skip to contentSkip to conversation

Staging: rtl8192e: array overflow in rtl92e_set_swcam()

PATCH In review Dan Carpenter 2 participants 2 messages Jul 28, 2015

Subsystems (2)
Staging Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/2 Staging: rtl8192e: array overflow in rtl92e_set_swcam()

"EntryNo" is comes from the user in the ioctl and it's a number between 0-255. The ieee->swcamtable[] array only has 32 elements so it can result in memory corruption.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/rtl8192e/rtl8192e/rtl_cam.c +4 -0
index dc8c7a8..c146b7e 100644
@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
 	RT_TRACE(COMP_DBG,
 		 "======>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
 		 __func__, EntryNo, KeyIndex, KeyType, is_mesh);
+
+	if (EntryNo >= TOTAL_CAM_ENTRY)
+		return;
+
 	if (!is_mesh) {
 		ieee->swcamtable[EntryNo].bused = true;
 		ieee->swcamtable[EntryNo].key_index = KeyIndex;
#1 lore raw
Quoted 12 lines · Dan Carpenter

"EntryNo" is comes from the user in the ioctl and it's a number between 0-255. The ieee->swcamtable[] array only has 32 elements so it can result in memory corruption.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/rtl8192e/rtl8192e/rtl_cam.c +0 -0
index dc8c7a8..c146b7e 100644

drivers/staging/rtl8192e/rtl8192e/rtl_cam.c void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex, · line 87

Quoted 10 lines
drivers/staging/rtl8192e/rtl8192e/rtl_cam.c +4 -0
@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
 	RT_TRACE(COMP_DBG,
 		 "======>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
 		 __func__, EntryNo, KeyIndex, KeyType, is_mesh);
+
+	if (EntryNo >= TOTAL_CAM_ENTRY)
+		return;
+
 	if (!is_mesh) {
 		ieee->swcamtable[EntryNo].bused = true;
 		ieee->swcamtable[EntryNo].key_index = KeyIndex;

+1 for both patches - thanks for finding this.