| commit | 1e3d31c589a6bcb05cd7fccccf9657c27b0e3dd1 | |
| author | Roel Kluin <roel.kluin@gmail.com> | |
| Sun, 2 Aug 2009 07:44:12 +0000 (2 09:44 +0200) | ||
| committer | John W. Linville <linville@tuxdriver.com> | |
| Fri, 28 Aug 2009 18:40:35 +0000 (28 14:40 -0400) | ||
| tree | e8a3cee9d0e1680a06db7b557bae254d465c912d | treesnapshot (tar.gz zip) |
| parent | 1c4e9ab3f1cc458306b3b910000371ba4f71c4d2 | commitdiff |
libertas: Read buffer overflow
Check whether index is within bounds before testing the element.
(also includes "Libertas: Association request to the driver failed"
The size of the tmp buffer was too small, causing a regression
rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.
In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Check whether index is within bounds before testing the element.
(also includes "Libertas: Association request to the driver failed"
The size of the tmp buffer was too small, causing a regression
rates->rates has an arraysize of 1, so a memcpy with
MAX_RATES (14) was already causing reads out of bounds.
In get_common_rates() the memset/memcpy can be moved upwards. -- JWL)
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Tested-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| drivers/net/wireless/libertas/assoc.c | diffblobblamehistory |