Dan Carpenter e6fdc25759 ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() ...

commit 260a9ad944 upstream.

The "ext->key_len" is a u16 that comes from the user.  If it's over
SCM_KEY_LEN (32) that could lead to memory corruption.

Fixes: e0d369d1d9 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-05-22 10:59:25 +02:00

..

ipw2x00

ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()

2021-05-22 10:59:25 +02:00

iwlegacy

iwlegacy: Check the return value of pcie_capability_read_*()

2020-08-19 08:14:52 +02:00

iwlwifi

iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_gen2_enqueue_hcmd()

2021-05-07 10:49:25 +02:00

Kconfig

net/wireless: fix spaces and grammar copy/paste in vendor Kconfig help text

2018-03-13 18:52:25 +02:00

Makefile

iwlwifi: move under intel vendor directory

2015-11-18 14:28:30 +02:00