staging: vt6655: buffer overflow in ioctl

Dan Carpenter · gregkh · commit ed87c2b2e7dd · 2014-09-19T15:32:20.000-07:00
-&gt;u.generic_elem.len is a user controlled number between 0-255.  We
should limit it to avoid memory corruption.

Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
@@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice,
 {
 	PSMgmtObject    pMgmt = pDevice->pMgmt;
 
+	if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))
+		return -EINVAL;
+
 	memcpy(pMgmt->abyWPAIE,
 	       param->u.generic_elem.data,
 	       param->u.generic_elem.len

Original file line number	Diff line number	Diff line change
`@@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice,`
`350`	`350`	`{`
`351`	`351`	`PSMgmtObject pMgmt = pDevice->pMgmt;`
`352`	`352`
	`353`	`+ if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))`
	`354`	`+ return -EINVAL;`
	`355`	`+`
`353`	`356`	`memcpy(pMgmt->abyWPAIE,`
`354`	`357`	`param->u.generic_elem.data,`
`355`	`358`	`param->u.generic_elem.len`