Skip to contentSkip to conversation

staging: wfx: check ssidlen and prevent an array overflow

PATCH In review Dan Carpenter 2 participants 2 messages Apr 24, 2020

Subsystems (2)
Staging Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 staging: wfx: check ssidlen and prevent an array overflow

We need to cap "ssidlen" to prevent a memcpy() overflow.

Fixes 40115bbc40e2 ("staging: wfx: implement the rest of mac80211 API")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/staging/wfx/sta.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/wfx/sta.c +3 -1
index c73dbb3a0de8c..3bff0f1e3d9ba 100644
@@ -479,7 +479,9 @@ static void wfx_do_join(struct wfx_vif *wvif)
 		ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
 	if (ssidie) {
 		ssidlen = ssidie[1];
-		memcpy(ssid, &ssidie[2], ssidie[1]);
+		if (ssidlen > IEEE80211_MAX_SSID_LEN)
+			ssidlen = IEEE80211_MAX_SSID_LEN;
+		memcpy(ssid, &ssidie[2], ssidlen);
 	}
 	rcu_read_unlock();
Signature · 1 line
2.26.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 14 lines · On Friday 24 April 2020 12:42:35 CEST Dan Carpenter wrote:

We need to cap "ssidlen" to prevent a memcpy() overflow.

Fixes 40115bbc40e2 ("staging: wfx: implement the rest of mac80211 API")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/staging/wfx/sta.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/staging/wfx/sta.c +0 -0
index c73dbb3a0de8c..3bff0f1e3d9ba 100644

drivers/staging/wfx/sta.c static void wfx_do_join(struct wfx_vif *wvif) · line 483

Quoted 6 lines
drivers/staging/wfx/sta.c +2 -1
@@ -479,7 +479,9 @@ static void wfx_do_join(struct wfx_vif *wvif)
                ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
        if (ssidie) {
                ssidlen = ssidie[1];
-               memcpy(ssid, &ssidie[2], ssidie[1]);
+               if (ssidlen > IEEE80211_MAX_SSID_LEN)
+                       ssidlen = IEEE80211_MAX_SSID_LEN;

I'd have a little preference for sizeof(ssid) instead of IEEE80211_MAX_SSID_LEN, but ok.

Quoted 7 lines
drivers/staging/wfx/sta.c +1 -1
+               memcpy(ssid, &ssidie[2], ssidlen);
        }
        rcu_read_unlock();
 
--

2.26.1

Reviewed-by Jérôme Pouiller <[email protected]>
Signature · 1 line
Jérôme Pouiller