system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-10-11 22:05:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

mwifiex: correct max IE length check for WPS IE

Browse source 
This patch is bug fix for an invalid boundry check for WPS IE.
We should check max IE length against defined macro; instead we were
checking it against size of pointer. Fix it.
Also move IE length check before allocation of memory.

Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Avinash Patil 2013-07-22 19:17:46 -07:00 committed by John W. Linville
parent 5e4c07987f
commit 8795ca61e4
1 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/net/wireless/mwifiex/sta_ioctl.c
View file

@ -797,15 +797,16 @@ static int mwifiex_set_wps_ie(struct mwifiex_private *priv,
u8 *ie_data_ptr, u16 ie_len)
{
if (ie_len) {
if (ie_len > MWIFIEX_MAX_VSIE_LEN) {
dev_dbg(priv->adapter->dev,
"info: failed to copy WPS IE, too big\n");
return -1;
}
priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL);
if (!priv->wps_ie)
return -ENOMEM;
if (ie_len > sizeof(priv->wps_ie)) {
dev_dbg(priv->adapter->dev,
"info: failed to copy WPS IE, too big\n");
kfree(priv->wps_ie);
return -1;
}
memcpy(priv->wps_ie, ie_data_ptr, ie_len);
priv->wps_ie_len = ie_len;
dev_dbg(priv->adapter->dev, "cmd: Set wps_ie_len=%d IE=%#x\n",