Re: [PATCH] staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan
From: Greg KH
Date: Fri Feb 26 2021 - 07:07:32 EST
On Fri, Feb 26, 2021 at 11:48:29AM +0000, Lee Gibson wrote:
>
Function _rtl92e_wx_set_scan calls memcpy without checking the length.
>
A user could control that length and trigger a buffer overflow.
>
Fix by checking the length is within the maximum allowed size.
>
>
Signed-off-by: Lee Gibson <leegib@xxxxxxxxx>
>
---
>
drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 3 +++
>
1 file changed, 3 insertions(+)
>
>
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
>
index 16bcee13f64b..2acc4f314732 100644
>
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
>
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
>
@@ -406,6 +406,9 @@ static int _rtl92e_wx_set_scan(struct net_device *dev,
>
struct iw_scan_req *req = (struct iw_scan_req *)b;
>
>
if (req->essid_len) {
>
+ if (req->essid_len > IW_ESSID_MAX_SIZE)
>
+ req->essid_len = IW_ESSID_MAX_SIZE;
>
+
How about using the "pattern" the other wireless drivers use of:
int len = min((int)req->essid_len, IW_ESSID_MAX_SIZE);
instead?
thanks,
greg k-h