| commit | 7f503fc49f144bb509dbd33daf3426df3f176e6b | |
| author | Stanislaw Gruszka <stf_xl@wp.pl> | |
| Sun, 19 Jun 2011 17:46:02 +0000 (19 19:46 +0200) | ||
| committer | John W. Linville <linville@tuxdriver.com> | |
| Wed, 22 Jun 2011 20:09:44 +0000 (22 16:09 -0400) | ||
| tree | 33c71c73da165d47b2d059311cce4a00dbf70bbb | treesnapshot (tar.gz zip) |
| parent | 9c803a03bc07553f8148d024c15c784b28c1d9ee | commitdiff |
rt2x00: fix possible memory corruption in case of invalid rxdesc.size
Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.
Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| drivers/net/wireless/rt2x00/rt2x00dev.c | diffblobblamehistory |