Commit e48d661e authored by Kees Cook's avatar Kees Cook Committed by Kalle Valo

ray_cs: Avoid reading past end of buffer

Using memcpy() from a buffer that is shorter than the length copied means
the destination buffer is being filled with arbitrary data from the kernel
rodata segment. In this case, the source was made longer, since it did not
match the destination structure size. Additionally removes a needless cast.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 0aeffa70
...@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_parms[] = { ...@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_parms[] = {
0x04, 0x08, /* Noise gain, limit offset */ 0x04, 0x08, /* Noise gain, limit offset */
0x28, 0x28, /* det rssi, med busy offsets */ 0x28, 0x28, /* det rssi, med busy offsets */
7, /* det sync thresh */ 7, /* det sync thresh */
0, 2, 2 /* test mode, min, max */ 0, 2, 2, /* test mode, min, max */
0, /* rx/tx delay */
0, 0, 0, 0, 0, 0, /* current BSS id */
0 /* hop set */
}; };
/*===========================================================================*/ /*===========================================================================*/
...@@ -597,7 +600,7 @@ static void init_startup_params(ray_dev_t *local) ...@@ -597,7 +600,7 @@ static void init_startup_params(ray_dev_t *local)
* a_beacon_period = hops a_beacon_period = KuS * a_beacon_period = hops a_beacon_period = KuS
*//* 64ms = 010000 */ *//* 64ms = 010000 */
if (local->fw_ver == 0x55) { if (local->fw_ver == 0x55) {
memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms, memcpy(&local->sparm.b4, b4_default_startup_parms,
sizeof(struct b4_startup_params)); sizeof(struct b4_startup_params));
/* Translate sane kus input values to old build 4/5 format */ /* Translate sane kus input values to old build 4/5 format */
/* i = hop time in uS truncated to 3 bytes */ /* i = hop time in uS truncated to 3 bytes */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment