diff options
| author | dataanddreams <dataanddreams@gmail.com> | 2015-12-04 10:28:53 -0500 |
|---|---|---|
| committer | Simon Shields <keepcalm444@gmail.com> | 2016-03-12 22:23:53 +1100 |
| commit | d75110451e7c79cbe3daf0a0088331b7021e8627 (patch) | |
| tree | 852d7556b01226f7bd54f5c25d4ed37b4a4e0e5e /drivers/net | |
| parent | c3f6d1154c2af856d66c6367f91bcb6efceced8a (diff) | |
| download | kernel_samsung_smdk4412-d75110451e7c79cbe3daf0a0088331b7021e8627.zip kernel_samsung_smdk4412-d75110451e7c79cbe3daf0a0088331b7021e8627.tar.gz kernel_samsung_smdk4412-d75110451e7c79cbe3daf0a0088331b7021e8627.tar.bz2 | |
net: wireless: bcmdhd: Add checks for stack buffer overflows
These two checks prevent exploitable buffer overflows in two scenarios.
1. Long WPS_ID_DEVICE_NAME in WPS info elements
2. Invalid SSID determined in certain scan results
Bug: 25661991
Change-Id: I356c71b3ccda765b03a1a380c39e199c3c3e3261
Signed-off-by: Yuan Lin <yualin@google.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/bcmdhd/wl_cfg80211.c | 5 |
1 files changed, 0 insertions, 5 deletions
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c index 5073913..ba000ef 100644 --- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c +++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c @@ -9095,11 +9095,6 @@ wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev, memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID, ssid[i].ssid_len); request->n_ssids++; - memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID, - netinfo->pfnsubnet.SSID_len); - ssid[i].ssid_len = netinfo->pfnsubnet.SSID_len; - request->n_ssids++; - channel_req = netinfo->pfnsubnet.channel; band = (channel_req <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ : NL80211_BAND_5GHZ; |