]> git.baikalelectronics.ru Git - kernel.git/commit
mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
authorWen Huang <huangwenabc@gmail.com>
Wed, 28 Aug 2019 02:07:51 +0000 (10:07 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 3 Sep 2019 13:50:21 +0000 (16:50 +0300)
commit6bed727069aafe84e226eb8db8104b62276c4fd9
tree926f8c0a3bb5c8cff8ee3a1d5d8a4a85e94e853b
parent9dde7032254c0c9395b8cbe44347151bc448f08e
mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings

mwifiex_update_vs_ie(),mwifiex_set_uap_rates() and
mwifiex_set_wmm_params() call memcpy() without checking
the destination size.Since the source is given from
user-space, this may trigger a heap buffer overflow.

Fix them by putting the length check before performing memcpy().

This fix addresses CVE-2019-14814,CVE-2019-14815,CVE-2019-14816.

Signed-off-by: Wen Huang <huangwenabc@gmail.com>
Acked-by: Ganapathi Bhat <gbhat@marvell.comg>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/ie.c
drivers/net/wireless/marvell/mwifiex/uap_cmd.c