lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

staging: r8712u: Fix possible out-of-bounds index with TKIP and AES keys

Browse Source 
Array XGrpKey has only 2 elements and uses (keyid - 1) as the index, which
allows the possibility of memory corruption from an out-of-bounds index.

This problem was reported by a new version of smatch.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Larry Finger 2011-10-08 14:01:06 -05:00 committed by Greg Kroah-Hartman
parent 8550be08cb
commit 447ff88652
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/rtl8712/rtl871x_mlme.c
View File

@ -1281,12 +1281,16 @@ sint r8712_set_key(struct _adapter *adapter,
psecuritypriv->DefKey[keyid].skey, keylen);
break;
case _TKIP_:
if (keyid < 1 || keyid > 2)
return _FAIL;
keylen = 16;
memcpy(psetkeyparm->key,
&psecuritypriv->XGrpKey[keyid - 1], keylen);
psetkeyparm->grpkey = 1;
break;
case _AES_:
if (keyid < 1 || keyid > 2)
return _FAIL;
keylen = 16;
memcpy(psetkeyparm->key,
&psecuritypriv->XGrpKey[keyid - 1], keylen);