diff options
| author | Luciano Coelho <coelho@ti.com> | 2011-04-01 19:46:40 +0300 |
|---|---|---|
| committer | Dmitry Shmidt <dimitrysh@google.com> | 2011-04-05 14:36:18 -0700 |
| commit | 759a6d35621cbdfef8bd28b0abab19f18218fe0f (patch) | |
| tree | 79fb571ac047a245873ef59c98877b0816fb4c9c | |
| parent | e49bb4e1261d0c7c698be51d0d3042cc705ded5d (diff) | |
| download | pandroid-759a6d35621cbdfef8bd28b0abab19f18218fe0f.tar.gz | |
wl12xx: fix potential buffer overflow in testmode nvs push
We were allocating the size of the NVS file according to the chip ID
and not checking whether the length of the buffer passed was correct
before copying it into the allocated memory. This is a security hole
because buffer overflows can occur if the userspace passes a bigger
file than what is expected.
With this patch, we check if the size of the data passed from
userspace matches the size required by the chip.
Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
| -rw-r--r-- | drivers/net/wireless/wl12xx/testmode.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c index 08638599ff5..9b9f6c921e2 100644 --- a/drivers/net/wireless/wl12xx/testmode.c +++ b/drivers/net/wireless/wl12xx/testmode.c @@ -205,11 +205,13 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[]) kfree(wl->nvs); - if (wl->chip.id == CHIP_ID_1283_PG20) - wl->nvs = kzalloc(sizeof(struct wl128x_nvs_file), GFP_KERNEL); - else - wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL); + if ((wl->chip.id == CHIP_ID_1283_PG20) && + (len != sizeof(struct wl128x_nvs_file))) + return -EINVAL; + else if (len != sizeof(struct wl1271_nvs_file)) + return -EINVAL; + wl->nvs = kzalloc(len, GFP_KERNEL); if (!wl->nvs) { wl1271_error("could not allocate memory for the nvs " "file"); |