]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
authorQing Xu <m1s5p6688@gmail.com>
Thu, 2 Jan 2020 02:39:26 +0000 (10:39 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 27 Jan 2020 14:34:33 +0000 (16:34 +0200)
commit3a9b153c5591548612c3955c9600a98150c81875
tree18b88a95bce13e883291a3feca23be5d599d50e0
parent65b1aae0d9d5962faccc06bdb8e91a2a0b09451c
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/wmm.c