mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()

Browse source

mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

...

This commit is contained in:

Qing Xu 2020-01-02 10:39:27 +08:00 • committed by Kalle Valo

parent 3a9b153c55

commit b70261a288

1 changed files with 7 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/net/wireless/marvell/mwifiex/scan.c

View file