Commit 3d0ccd02 authored by Roel Kluin's avatar Roel Kluin Committed by John W. Linville

airo: Buffer overflow

SSID_rid has space for only 3 ssids.
txPowerLevels[i] is read before the bounds check for i
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Acked-by: default avatarDan Williams <dcbw@redhat.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 2a21f869
...@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev, ...@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
readSsidRid(local, &SSID_rid); readSsidRid(local, &SSID_rid);
/* Check if we asked for `any' */ /* Check if we asked for `any' */
if(dwrq->flags == 0) { if (dwrq->flags == 0) {
/* Just send an empty SSID list */ /* Just send an empty SSID list */
memset(&SSID_rid, 0, sizeof(SSID_rid)); memset(&SSID_rid, 0, sizeof(SSID_rid));
} else { } else {
int index = (dwrq->flags & IW_ENCODE_INDEX) - 1; unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
/* Check the size of the string */ /* Check the size of the string */
if(dwrq->length > IW_ESSID_MAX_SIZE) { if (dwrq->length > IW_ESSID_MAX_SIZE)
return -E2BIG ; return -E2BIG ;
}
/* Check if index is valid */ /* Check if index is valid */
if((index < 0) || (index >= 4)) { if (index >= ARRAY_SIZE(SSID_rid.ssids))
return -EINVAL; return -EINVAL;
}
/* Set the SSID */ /* Set the SSID */
memset(SSID_rid.ssids[index].ssid, 0, memset(SSID_rid.ssids[index].ssid, 0,
...@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev, ...@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
return -EINVAL; return -EINVAL;
} }
clear_bit (FLAG_RADIO_OFF, &local->flags); clear_bit (FLAG_RADIO_OFF, &local->flags);
for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++) for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
if (v == cap_rid.txPowerLevels[i]) { if (v == cap_rid.txPowerLevels[i]) {
readConfigRid(local, 1); readConfigRid(local, 1);
local->config.txPower = v; local->config.txPower = v;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment