Skip to content

Commit 8710751

Browse files
Dan Carpentergregkh
authored andcommitted
staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
We need to cap len at IW_ESSID_MAX_SIZE (32) to avoid memory corruption. This can be controlled by the user via the ioctl. Fixes: 5f53d8c ("Staging: add rtl8192SU wireless usb driver") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/YEHoAWMOSZBUw91F@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent fd3ce65 commit 8710751

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

drivers/staging/rtl8192u/r8192U_wx.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,10 @@ static int r8192_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
331331
struct iw_scan_req *req = (struct iw_scan_req *)b;
332332

333333
if (req->essid_len) {
334-
ieee->current_network.ssid_len = req->essid_len;
335-
memcpy(ieee->current_network.ssid, req->essid, req->essid_len);
334+
int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
335+
336+
ieee->current_network.ssid_len = len;
337+
memcpy(ieee->current_network.ssid, req->essid, len);
336338
}
337339
}
338340

0 commit comments

Comments
 (0)