diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-10-18 09:27:25 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-10-19 13:42:48 -0700 |
| commit | 6b7200fe0a59d7bda59e9e028b235b25a137dff9 (patch) | |
| tree | 315186dbdf9d827fccf3960428f80f9abd54c9ff /drivers/staging/vt6655 | |
| parent | 4535743304c7652f8e4a6dc35276d466fd97c0e3 (diff) | |
Staging: vt6655: memory corruption in check in wpa_set_wpadev()
The original code left it up to the user to decide how much data to
copy, but that doesn't work with a fixed size array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/vt6655')
| -rw-r--r-- | drivers/staging/vt6655/wpactl.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/staging/vt6655/wpactl.c b/drivers/staging/vt6655/wpactl.c index a0f994ed58fe..732ba88dc796 100644 --- a/drivers/staging/vt6655/wpactl.c +++ b/drivers/staging/vt6655/wpactl.c @@ -213,7 +213,9 @@ int wpa_set_wpadev(PSDevice pDevice, int val) int uu, ii; - if (param->u.wpa_key.alg_name > WPA_ALG_CCMP) + if (param->u.wpa_key.alg_name > WPA_ALG_CCMP || + param->u.wpa_key.key_len >= MAX_KEY_LEN || + param->u.wpa_key.seq_len >= MAX_KEY_LEN) return -EINVAL; DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "param->u.wpa_key.alg_name = %d \n", param->u.wpa_key.alg_name); |