Skip to content

Commit

Permalink
staging: rtl8723bs: prevent ->Ssid overflow in rtw_wx_set_scan()
Browse files Browse the repository at this point in the history
This code has a check to prevent read overflow but it needs another
check to prevent writing beyond the end of the ->Ssid[] array.

Fixes: 554c0a3 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <[email protected]>
Signed-off-by: Denis Efremov (Oracle) <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
  • Loading branch information
evdenis authored and gregkh committed Jun 6, 2022
1 parent 06293f7 commit 71b2a87
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
Original file line number Diff line number Diff line change
Expand Up @@ -1359,9 +1359,11 @@ static int rtw_wx_set_scan(struct net_device *dev, struct iw_request_info *a,

sec_len = *(pos++); len-= 1;

if (sec_len>0 && sec_len<=len) {
if (sec_len > 0 &&
sec_len <= len &&
sec_len <= 32) {
ssid[ssid_index].SsidLength = sec_len;
memcpy(ssid[ssid_index].Ssid, pos, ssid[ssid_index].SsidLength);
memcpy(ssid[ssid_index].Ssid, pos, sec_len);
/* DBG_871X("%s COMBO_SCAN with specific ssid:%s, %d\n", __func__ */
/* , ssid[ssid_index].Ssid, ssid[ssid_index].SsidLength); */
ssid_index++;
Expand Down

0 comments on commit 71b2a87

Please sign in to comment.