[PATCH] wl1251: Fix possible buffer overflow in wl1251_cmd_scan
From: Lee Gibson <hidden>
Date: 2021-03-17 12:18:57
Also in:
linux-wireless, lkml
Subsystem:
the rest, ti wilink wireless drivers · Maintainer:
Linus Torvalds
Function wl1251_cmd_scan calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size. Signed-off-by: Lee Gibson <redacted> --- drivers/net/wireless/ti/wl1251/cmd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index 498c8db2eb48..e4d028a53d91 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c@@ -455,8 +455,11 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len, } cmd->params.ssid_len = ssid_len; - if (ssid) - memcpy(cmd->params.ssid, ssid, ssid_len); + if (ssid) { + int len = min_t(int, ssid_len, IEEE80211_MAX_SSID_LEN); + + memcpy(cmd->params.ssid, ssid, len); + } ret = wl1251_cmd_send(wl, CMD_SCAN, cmd, sizeof(*cmd)); if (ret < 0) {
--
2.25.1