diff mbox series

staging: wilc1000: potential corruption in wilc_parse_join_bss_param()

Message ID 20191017091832.GB31278@mwanda (mailing list archive)
State Not Applicable
Delegated to: Johannes Berg
Headers show
Series staging: wilc1000: potential corruption in wilc_parse_join_bss_param() | expand

Commit Message

Dan Carpenter Oct. 17, 2019, 9:18 a.m. UTC 
The "rates_len" value needs to be capped so that the memcpy() doesn't
copy beyond the end of the array.

Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/staging/wilc1000/wilc_hif.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Adham Abozaeid Oct. 17, 2019, 5:06 p.m. UTC | #1 
On 10/17/19 2:18 AM, Dan Carpenter wrote:
> The "rates_len" value needs to be capped so that the memcpy() doesn't
> copy beyond the end of the array.
>
> Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/staging/wilc1000/wilc_hif.c | 2 ++
>  1 file changed, 2 insertions(+)

Reviewed-by: Adham Abozaeid <adham.abozaeid@microchip.com>

Thanks Dan for the patch.
diff mbox series

Patch

diff --git a/drivers/staging/wilc1000/wilc_hif.c b/drivers/staging/wilc1000/wilc_hif.c
index 0ac2b6ac50b0..e0a95c5cc0d5 100644
--- a/drivers/staging/wilc1000/wilc_hif.c
+++ b/drivers/staging/wilc1000/wilc_hif.c
@@ -479,6 +479,8 @@  void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
 	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len);
 	if (rates_ie) {
 		rates_len = rates_ie[1];
+		if (rates_len > WILC_MAX_RATES_SUPPORTED)
+			rates_len = WILC_MAX_RATES_SUPPORTED;
 		param->supp_rates[0] = rates_len;
 		memcpy(&param->supp_rates[1], rates_ie + 2, rates_len);
 	}