shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity

net: wireless: rockchip_wlan: realtek wifi: fix buffer overflow issue in rtw_ioctl_wext_private

Browse Source 
References: CNVD-C-2020-263891
Signed-off-by: Weiguo Hu <hwg@rock-chips.com>
Change-Id: If80c197d9e806a04a14a3a8dbe195942deed46eb
This commit is contained in:
Weiguo Hu
2020-11-17 14:29:34 +08:00
committed by Tao Huang
parent a24abc2faf
commit 3879e152ce
11 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c
View File

@@ -13095,7 +13095,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -13114,7 +13114,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c
View File

@@ -13705,7 +13705,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 4096) break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
} while (1);
@@ -13723,7 +13723,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 1024) break;
sscanf(str, "%i", &temp);
((s32*)buffer)[count++] = (s32)temp;
} while (1);

4
drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c
View File

@@ -13660,7 +13660,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 4096) break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
} while (1);
@@ -13678,7 +13678,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 1024) break;
sscanf(str, "%i", &temp);
((s32*)buffer)[count++] = (s32)temp;
} while (1);

4
drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c
View File

@@ -12598,7 +12598,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12617,7 +12617,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c
View File

@@ -12792,7 +12792,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12811,7 +12811,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c
View File

@@ -13586,7 +13586,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 4096) break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
} while (1);
@@ -13604,7 +13604,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 1024) break;
sscanf(str, "%i", &temp);
((s32*)buffer)[count++] = (s32)temp;
} while (1);

4
drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c
View File

@@ -12751,7 +12751,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12770,7 +12770,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c
View File

@@ -12625,7 +12625,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12644,7 +12644,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c
View File

@@ -12613,7 +12613,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12632,7 +12632,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c
View File

@@ -12930,7 +12930,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12949,7 +12949,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c
View File

@@ -12589,7 +12589,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@@ -12608,7 +12608,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;