[PATCH V2] staging: r8712u: Fix possible out-of-bounds index with TKIP and AES keys
Larry Finger
Larry.Finger at lwfinger.net
Sat Oct 8 19:01:06 UTC 2011
Array XGrpKey has only 2 elements and uses (keyid - 1) as the index, which
allows the possibility of memory corruption from an out-of-bounds index.
This problem was reported by a new version of smatch.
Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
Signed-off-by: Larry Finger <Larry.Finger at lwfinger.net>
---
V2 - forgot to refresh patch before saending.
---
Index: wireless-testing-new/drivers/staging/rtl8712/rtl871x_mlme.c
===================================================================
--- wireless-testing-new.orig/drivers/staging/rtl8712/rtl871x_mlme.c
+++ wireless-testing-new/drivers/staging/rtl8712/rtl871x_mlme.c
@@ -1271,12 +1271,16 @@ sint r8712_set_key(struct _adapter *adap
psecuritypriv->DefKey[keyid].skey, keylen);
break;
case _TKIP_:
+ if (keyid < 1 || keyid > 2)
+ return _FAIL;
keylen = 16;
memcpy(psetkeyparm->key,
&psecuritypriv->XGrpKey[keyid - 1], keylen);
psetkeyparm->grpkey = 1;
break;
case _AES_:
+ if (keyid < 1 || keyid > 2)
+ return _FAIL;
keylen = 16;
memcpy(psetkeyparm->key,
&psecuritypriv->XGrpKey[keyid - 1], keylen);
More information about the devel
mailing list