mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-12 11:36:35 +00:00
Code Issues Releases Wiki Activity

Staging: rtl8192e: array overflow in rtl92e_set_swcam()

Browse source 
"EntryNo" is comes from the user in the ioctl and it's a number between
0-255.  The ieee->swcamtable[] array only has 32 elements so it can
result in memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2015-07-28 18:48:21 +03:00 committed by Greg Kroah-Hartman
parent 881bf28123
commit d1f0f3118e
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
View file

@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
RT_TRACE(COMP_DBG,
"===========>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
__func__, EntryNo, KeyIndex, KeyType, is_mesh);
if (EntryNo >= TOTAL_CAM_ENTRY)
return;
if (!is_mesh) {
ieee->swcamtable[EntryNo].bused = true;
ieee->swcamtable[EntryNo].key_index = KeyIndex;