Commit d1f0f311 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

Staging: rtl8192e: array overflow in rtl92e_set_swcam()

"EntryNo" is comes from the user in the ioctl and it's a number between
0-255.  The ieee->swcamtable[] array only has 32 elements so it can
result in memory corruption.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 881bf281
...@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex, ...@@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex,
RT_TRACE(COMP_DBG, RT_TRACE(COMP_DBG,
"===========>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n", "===========>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n",
__func__, EntryNo, KeyIndex, KeyType, is_mesh); __func__, EntryNo, KeyIndex, KeyType, is_mesh);
if (EntryNo >= TOTAL_CAM_ENTRY)
return;
if (!is_mesh) { if (!is_mesh) {
ieee->swcamtable[EntryNo].bused = true; ieee->swcamtable[EntryNo].bused = true;
ieee->swcamtable[EntryNo].key_index = KeyIndex; ieee->swcamtable[EntryNo].key_index = KeyIndex;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment