From patchwork Sat Jul 25 21:02:32 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Roel Kluin X-Patchwork-Id: 37356 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n6PL0sBS027837 for ; Sat, 25 Jul 2009 21:00:55 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752728AbZGYU77 (ORCPT ); Sat, 25 Jul 2009 16:59:59 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752689AbZGYU77 (ORCPT ); Sat, 25 Jul 2009 16:59:59 -0400 Received: from mail-ew0-f226.google.com ([209.85.219.226]:64463 "EHLO mail-ew0-f226.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752627AbZGYU76 (ORCPT ); Sat, 25 Jul 2009 16:59:58 -0400 Received: by ewy26 with SMTP id 26so2428129ewy.37 for ; Sat, 25 Jul 2009 13:59:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:content-type :content-transfer-encoding; bh=YncuX217xqDXq56I8SRdFtoGX+8SHfS6wfhDUUOGV5c=; b=Z925++JKIfwJZN3cUo2ILdFbkouWjBiBrr06uA/oIzHSd2bNkM0AxNrC8m5W8QeGdJ x+oqCYFh8jFJ4H1/F1fDaODvKElG/UBDx4V4/vgAabLer7QKRO100pUd06oAMtblHY4M 2Z4V1HYeEcbhP8B6l4CmC8DO5lYjIU8VRnsMY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; b=n9FeMlxHE3MNVQd54+CUV3UfcBY19uEI12IZYJFBs9g2WK1ScKVnQOMgQ96FQp3OuM zTUWj83hn02sq3/DEyNBdBn6jZhmtl/J18amRvwSLgQqE5bV4n+gp9TpdLr/YQO4exIi bSuW5vjX8YpJCAehHrzaONlXUq1V2kJrQcrpk= Received: by 10.210.12.13 with SMTP id 13mr2884077ebl.12.1248555598231; Sat, 25 Jul 2009 13:59:58 -0700 (PDT) Received: from zoinx.mars (d133062.upc-d.chello.nl [213.46.133.62]) by mx.google.com with ESMTPS id 10sm6691970eyz.21.2009.07.25.13.59.57 (version=SSLv3 cipher=RC4-MD5); Sat, 25 Jul 2009 13:59:57 -0700 (PDT) Message-ID: <4A6B72E8.3060500@gmail.com> Date: Sat, 25 Jul 2009 23:02:32 +0200 From: Roel Kluin User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1b3pre) Gecko/20090513 Fedora/3.0-2.3.beta2.fc11 Thunderbird/3.0b2 MIME-Version: 1.0 To: linville@tuxdriver.com, linux-wireless@vger.kernel.org, Andrew Morton Subject: [PATCH] airo: Buffer overflow Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org SSID_rid has space for only 3 ssids. txPowerLevels[i] is read before the bounds check for i Signed-off-by: Roel Kluin Acked-by: Dan Williams --- -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c index c70604f..8ce5e4c 100644 --- a/drivers/net/wireless/airo.c +++ b/drivers/net/wireless/airo.c @@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev, readSsidRid(local, &SSID_rid); /* Check if we asked for `any' */ - if(dwrq->flags == 0) { + if (dwrq->flags == 0) { /* Just send an empty SSID list */ memset(&SSID_rid, 0, sizeof(SSID_rid)); } else { - int index = (dwrq->flags & IW_ENCODE_INDEX) - 1; + unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1; /* Check the size of the string */ - if(dwrq->length > IW_ESSID_MAX_SIZE) { + if (dwrq->length > IW_ESSID_MAX_SIZE) return -E2BIG ; - } + /* Check if index is valid */ - if((index < 0) || (index >= 4)) { + if (index >= ARRAY_SIZE(SSID_rid.ssids)) return -EINVAL; - } /* Set the SSID */ memset(SSID_rid.ssids[index].ssid, 0, @@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev, return -EINVAL; } clear_bit (FLAG_RADIO_OFF, &local->flags); - for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++) + for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++) if (v == cap_rid.txPowerLevels[i]) { readConfigRid(local, 1); local->config.txPower = v;