lkml.org 
[lkml]   [2020]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 167/477] staging: wilc1000: Increase the size of wid_list array
    Date
    From: Oscar Carter <oscar.carter@gmx.com>

    [ Upstream commit a4338ed2e1cf724563956ec5f91deeaabfedbe23 ]

    Increase by one the size of wid_list array as index variable can reach a
    value of 5. If this happens, an out-of-bounds access is performed.

    Also, use a #define instead of a hard-coded literal for the new array
    size.

    Addresses-Coverity-ID: 1451981 ("Out-of-bounds access")
    Fixes: f5a3cb90b802d ("staging: wilc1000: add passive scan support")
    Acked-by: Ajay Singh <ajay.kathat@microchip.com>
    Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
    Link: https://lore.kernel.org/r/20200504150911.4470-1-oscar.carter@gmx.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/wilc1000/hif.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/staging/wilc1000/hif.c b/drivers/staging/wilc1000/hif.c
    index 6c7de2f8d3f26..d025a30930157 100644
    --- a/drivers/staging/wilc1000/hif.c
    +++ b/drivers/staging/wilc1000/hif.c
    @@ -11,6 +11,8 @@

    #define WILC_FALSE_FRMWR_CHANNEL 100

    +#define WILC_SCAN_WID_LIST_SIZE 6
    +
    struct wilc_rcvd_mac_info {
    u8 status;
    };
    @@ -151,7 +153,7 @@ int wilc_scan(struct wilc_vif *vif, u8 scan_source, u8 scan_type,
    void *user_arg, struct cfg80211_scan_request *request)
    {
    int result = 0;
    - struct wid wid_list[5];
    + struct wid wid_list[WILC_SCAN_WID_LIST_SIZE];
    u32 index = 0;
    u32 i, scan_timeout;
    u8 *buffer;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-06-23 23:36    [W:4.275 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site