Staging: rtl8192e: array overflow in rtl92e_set_swcam()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 28 Jul 2015 15:48:21 +0000 (18:48 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 31 Jul 2015 23:18:43 +0000 (16:18 -0700)
"EntryNo" is comes from the user in the ioctl and it's a number between
0-255.  The ieee->swcamtable[] array only has 32 elements so it can
result in memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/rtl8192e/rtl8192e/rtl_cam.c

index dc8c7a86bf93c03a4e4c7b26488b5429d717448e..c146b7e720a94597c3a14543e9f7cdd29f3cdfaf 100644 (file)
@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
        RT_TRACE(COMP_DBG,
                 "===========>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
                 __func__, EntryNo, KeyIndex, KeyType, is_mesh);
+
+       if (EntryNo >= TOTAL_CAM_ENTRY)
+               return;
+
        if (!is_mesh) {
                ieee->swcamtable[EntryNo].bused = true;
                ieee->swcamtable[EntryNo].key_index = KeyIndex;