Staging: rtl8192e: array overflow in rtl92e_set_swcam()
"EntryNo" is comes from the user in the ioctl and it's a number between 0-255. The ieee->swcamtable[] array only has 32 elements so it can result in memory corruption. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing
Please register or sign in to comment