]> git.baikalelectronics.ru Git - kernel.git/commit
rt2x00: fix possible memory corruption in case of invalid rxdesc.size
authorStanislaw Gruszka <stf_xl@wp.pl>
Sun, 19 Jun 2011 17:46:02 +0000 (19:46 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 22 Jun 2011 20:09:44 +0000 (16:09 -0400)
commit59e57edb7d6ed1abd57d1ffd6b7d672a31607c2c
tree33c71c73da165d47b2d059311cce4a00dbf70bbb
parentde08d600c97a9f614eea40b1020c9772b4f4f05c
rt2x00: fix possible memory corruption in case of invalid rxdesc.size

Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/rt2x00/rt2x00dev.c