Dan Carpenter c9996845ff ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() ...

commit 260a9ad944 upstream.

The "ext->key_len" is a u16 that comes from the user.  If it's over
SCM_KEY_LEN (32) that could lead to memory corruption.

Fixes: e0d369d1d9 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-05-14 09:50:00 +02:00

..

ipw2x00

ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()

2021-05-14 09:50:00 +02:00

iwlegacy

net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros

2020-09-29 14:02:55 -07:00

iwlwifi

iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()

2021-05-02 11:06:08 +02:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

Makefile

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00