8687bf9ef9
Function _rtl92e_wx_set_scan calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size. Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Lee Gibson <leegib@gmail.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20210226145157.424065-1-leegib@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| rtl8192e | ||
| Kconfig | ||
| Makefile | ||
| TODO | ||
| dot11d.c | ||
| dot11d.h | ||
| rtl819x_BA.h | ||
| rtl819x_BAProc.c | ||
| rtl819x_HT.h | ||
| rtl819x_HTProc.c | ||
| rtl819x_Qos.h | ||
| rtl819x_TS.h | ||
| rtl819x_TSProc.c | ||
| rtllib.h | ||
| rtllib_crypt_ccmp.c | ||
| rtllib_crypt_tkip.c | ||
| rtllib_crypt_wep.c | ||
| rtllib_debug.h | ||
| rtllib_module.c | ||
| rtllib_rx.c | ||
| rtllib_softmac.c | ||
| rtllib_softmac_wx.c | ||
| rtllib_tx.c | ||
| rtllib_wx.c | ||