[patch 2/2] Staging: vt6656: add some range checks before memcpy()

[Dan Carpenter]

We need to verify that we're not writing past the end of the array.

Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>

diff --git a/drivers/staging/vt6656/ioctl.c b/drivers/staging/vt6656/ioctl.c
index 2cde4f0c..4939002 100644
--- a/drivers/staging/vt6656/ioctl.c
+++ b/drivers/staging/vt6656/ioctl.c
@@ -81,6 +81,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
                }
 
                pItemSSID = (PWLAN_IE_SSID)sScanCmd.ssid;
+               if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+                       return -EINVAL;
                if (pItemSSID->len != 0) {
                        memset(abyScanSSID, 0, WLAN_IEHDR_LEN + 
WLAN_SSID_MAXLEN + 1);
                        memcpy(abyScanSSID, pItemSSID, pItemSSID->len + 
WLAN_IEHDR_LEN);
@@ -155,6 +157,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
                }
 
                pItemSSID = (PWLAN_IE_SSID)sJoinCmd.ssid;
+               if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+                       return -EINVAL;
                memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + 
WLAN_SSID_MAXLEN + 1);
                memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + 
WLAN_IEHDR_LEN);
                if (sJoinCmd.wBSSType == ADHOC) {
@@ -476,6 +480,8 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
                }
 
                pItemSSID = (PWLAN_IE_SSID)sStartAPCmd.ssid;
+               if (pItemSSID->len > WLAN_SSID_MAXLEN + 1)
+                       return -EINVAL;
                memset(pMgmt->abyDesireSSID, 0, WLAN_IEHDR_LEN + 
WLAN_SSID_MAXLEN + 1);
                memcpy(pMgmt->abyDesireSSID, pItemSSID, pItemSSID->len + 
WLAN_IEHDR_LEN);
 
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel