Commit d1f0f311 authored Jul 28, 2015 by Dan Carpenter Committed by Greg Kroah-Hartman Jul 31, 2015

Staging: rtl8192e: array overflow in rtl92e_set_swcam()



"EntryNo" is comes from the user in the ioctl and it's a number between
0-255.  The ieee->swcamtable[] array only has 32 elements so it can
result in memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 881bf281

drivers/staging/rtl8192e/rtl8192e/rtl_cam.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
		RT_TRACE(COMP_DBG,
		"===========>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
		__func__, EntryNo, KeyIndex, KeyType, is_mesh);

		if (EntryNo >= TOTAL_CAM_ENTRY)
		return;

		if (!is_mesh) {
		ieee->swcamtable[EntryNo].bused = true;
		ieee->swcamtable[EntryNo].key_index = KeyIndex;