lkml.org 
[lkml]   [2018]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 13/67] staging: rtl8723bs: Prevent an underflow in rtw_check_beacon_data().
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Murray McAllister <murray.mcallister@insomniasec.com>

    commit 920c92448839bd4f8eb87a92b08cad56d449caff upstream.

    Dan Carpenter reported an integer underflow issue in the rtl8188eu driver.
    This is also needed for the length (signed integer) in rtl8723bs, as it is
    later converted to an unsigned integer and used in a memcpy operation.

    Original issue is at https://patchwork.kernel.org/patch/9796371/

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/staging/rtl8723bs/core/rtw_ap.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/staging/rtl8723bs/core/rtw_ap.c
    +++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
    @@ -1059,7 +1059,7 @@ int rtw_check_beacon_data(struct adapter
    return _FAIL;


    - if (len > MAX_IE_SZ)
    + if (len < 0 || len > MAX_IE_SZ)
    return _FAIL;

    pbss_network->IELength = len;

    \
     
     \ /
      Last update: 2018-07-16 09:58    [W:2.816 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site