Skip to content

Commit 3a9b153

Browse files
Qing XuKalle Valo
Qing Xu
authored and
Kalle Valo
committed
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
mwifiex_ret_wmm_get_status() calls memcpy() without checking the destination size.Since the source is given from remote AP which contains illegal wmm elements , this may trigger a heap buffer overflow. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu <m1s5p6688@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
1 parent 65b1aae commit 3a9b153

File tree

1 file changed

+4
-0
lines changed
  • drivers/net/wireless/marvell/mwifiex

1 file changed

+4
-0
lines changed

Diff for: drivers/net/wireless/marvell/mwifiex/wmm.c

+4
Original file line numberDiff line numberDiff line change
@@ -970,6 +970,10 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
970970
"WMM Parameter Set Count: %d\n",
971971
wmm_param_ie->qos_info_bitmap & mask);
972972

973+
if (wmm_param_ie->vend_hdr.len + 2 >
974+
sizeof(struct ieee_types_wmm_parameter))
975+
break;
976+
973977
memcpy((u8 *) &priv->curr_bss_params.bss_descriptor.
974978
wmm_ie, wmm_param_ie,
975979
wmm_param_ie->vend_hdr.len + 2);

0 commit comments

Comments
 (0)