staging: rtl8192u: change get_key functions to return 0 instead of -1

Browse source

Currently, these three get_key functions return -1 when the provided len
value is less a specific key length value, which can result in buffer
overflow depending on how the returned value is used. These functions are
used in three places in ieee80211/ieee80211_wx.c:

  ieee80211_wx_get_encode() :
    The behavior of this function will be unchanged.

  ieee80211_wx_get_encode_ext() :
    The result of the get_key function is written to ext->key_len,
    resulting in a buffer overflow if the result is negative.

  ieee80211_wx_set_encode() :
    The behavior of this function will change. When len is less than the
    key length value, it will set a default key of all 0.

Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rebecca Mckeever <remckee0@gmail.com>
Link: https://lore.kernel.org/r/Yl/7QPKXer7YtXOs@bertie
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Rebecca Mckeever 2022-04-20 07:23:28 -05:00 • committed by Greg Kroah-Hartman

parent 55de6cb7f8

commit 17c8129e06

3 changed files with 3 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c

View file

2

drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c

View file

2

drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c

View file