mwifiex: Abort at too short BSS descriptor element

Browse source

commit 685c9b7750 upstream.

Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that
the source descriptor entries contain the enough size for each type
and performs copying without checking the source size.  This may lead
to read over boundary.

Fix this by putting the source size check in appropriate places.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

...

This commit is contained in:

Takashi Iwai 2019-05-29 14:52:20 +02:00 • committed by Ben Hutchings

parent a24ac7326f

commit f287d86856

1 changed files with 15 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

15

drivers/net/wireless/mwifiex/scan.c

View file