mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

Browse source

[ Upstream commit 3a9b153c55 ]

mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Qing Xu 2020-01-02 10:39:26 +08:00 • committed by Greg Kroah-Hartman

parent a39b714198

commit f3a6883c5a

1 changed files with 4 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

drivers/net/wireless/marvell/mwifiex/wmm.c

View file