rt2x00: fix possible memory corruption in case of invalid rxdesc.size

Browse source

Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

...

This commit is contained in:

Stanislaw Gruszka 2011-06-19 19:46:02 +02:00 • committed by John W. Linville

parent 9c803a03bc

commit 7f503fc49f

1 changed files with 13 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

13

drivers/net/wireless/rt2x00/rt2x00dev.c

View file