Message ID | 20201208113607.24967-1-ruc_zhangxiaohui@163.com (mailing list archive) |
---|---|
State | Changes Requested |
Delegated to: | Kalle Valo |
Headers | show |
Series | [1/1] mwifiex: Fix possible buffer overflows in mwifiex_uap_bss_param_prepare | expand |
Xiaohui Zhang <ruc_zhangxiaohui@163.com> writes: > From: Zhang Xiaohui <ruc_zhangxiaohui@163.com> > > mwifiex_uap_bss_param_prepare() calls memcpy() without checking > the destination size may trigger a buffer overflower, > which a local user could use to cause denial of service or the > execution of arbitrary code. > Fix it by putting the length check before calling memcpy(). > > Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com> > --- > drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c > index b48a85d79..fb937c7ee 100644 > --- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c > +++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c > @@ -496,13 +496,16 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size) > struct mwifiex_ie_types_wmmcap *wmm_cap; > struct mwifiex_uap_bss_param *bss_cfg = cmd_buf; > int i; > + int ssid_size; > u16 cmd_size = *param_size; > > if (bss_cfg->ssid.ssid_len) { > ssid = (struct host_cmd_tlv_ssid *)tlv; > ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID); > ssid->header.len = cpu_to_le16((u16)bss_cfg->ssid.ssid_len); > - memcpy(ssid->ssid, bss_cfg->ssid.ssid, bss_cfg->ssid.ssid_len); > + ssid_size = bss_cfg->ssid.ssid_len > strlen(ssid->ssid) ? > + strlen(ssid->ssid) : bss_cfg->ssid.ssid_len; > + memcpy(ssid->ssid, bss_cfg->ssid.ssid, ssid_size); I think using min_t() is cleaner. Then you would not need to add a temporary variable.
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c index b48a85d79..fb937c7ee 100644 --- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c +++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c @@ -496,13 +496,16 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size) struct mwifiex_ie_types_wmmcap *wmm_cap; struct mwifiex_uap_bss_param *bss_cfg = cmd_buf; int i; + int ssid_size; u16 cmd_size = *param_size; if (bss_cfg->ssid.ssid_len) { ssid = (struct host_cmd_tlv_ssid *)tlv; ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID); ssid->header.len = cpu_to_le16((u16)bss_cfg->ssid.ssid_len); - memcpy(ssid->ssid, bss_cfg->ssid.ssid, bss_cfg->ssid.ssid_len); + ssid_size = bss_cfg->ssid.ssid_len > strlen(ssid->ssid) ? + strlen(ssid->ssid) : bss_cfg->ssid.ssid_len; + memcpy(ssid->ssid, bss_cfg->ssid.ssid, ssid_size); cmd_size += sizeof(struct mwifiex_ie_types_header) + bss_cfg->ssid.ssid_len; tlv += sizeof(struct mwifiex_ie_types_header) +