Commit 3d0ccd02 authored by Roel Kluin's avatar Roel Kluin Committed by John W. Linville

airo: Buffer overflow

SSID_rid has space for only 3 ssids.
txPowerLevels[i] is read before the bounds check for i
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Acked-by: default avatarDan Williams <dcbw@redhat.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 2a21f869
......@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
readSsidRid(local, &SSID_rid);
/* Check if we asked for `any' */
if(dwrq->flags == 0) {
if (dwrq->flags == 0) {
/* Just send an empty SSID list */
memset(&SSID_rid, 0, sizeof(SSID_rid));
} else {
int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
/* Check the size of the string */
if(dwrq->length > IW_ESSID_MAX_SIZE) {
if (dwrq->length > IW_ESSID_MAX_SIZE)
return -E2BIG ;
}
/* Check if index is valid */
if((index < 0) || (index >= 4)) {
if (index >= ARRAY_SIZE(SSID_rid.ssids))
return -EINVAL;
}
/* Set the SSID */
memset(SSID_rid.ssids[index].ssid, 0,
......@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
return -EINVAL;
}
clear_bit (FLAG_RADIO_OFF, &local->flags);
for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
if (v == cap_rid.txPowerLevels[i]) {
readConfigRid(local, 1);
local->config.txPower = v;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment