From ed87c2b2e7dd34016017af183b8f3fbe28179bc1 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 19 Sep 2014 13:43:11 +0300 Subject: [PATCH] staging: vt6655: buffer overflow in ioctl ->u.generic_elem.len is a user controlled number between 0-255. We should limit it to avoid memory corruption. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/staging/vt6655/hostap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c index f105c2ac091b..164136b07a68 100644 --- a/drivers/staging/vt6655/hostap.c +++ b/drivers/staging/vt6655/hostap.c @@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice, { PSMgmtObject pMgmt = pDevice->pMgmt; + if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE)) + return -EINVAL; + memcpy(pMgmt->abyWPAIE, param->u.generic_elem.data, param->u.generic_elem.len -- 2.20.1