mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()

Browse source

[ Upstream commit b70261a288 ]

mwifiex_cmd_append_vsie_tlv() calls memcpy() without checking
the destination size may trigger a buffer overflower,
which a local user could use to cause denial of service
or the execution of arbitrary code.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Qing Xu 2020-01-02 10:39:27 +08:00 • committed by Greg Kroah-Hartman

parent f3a6883c5a

commit fe07868104

1 changed files with 7 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/net/wireless/marvell/mwifiex/scan.c

View file