iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

staging: wilc1000: fix infinite loop and out-of-bounds access

Browse Source 
If i < slot_id is initially true then it will remain true. Also,
as i is being decremented it will end up accessing memory out of
bounds.

Fix this by incrementing *i* instead of decrementing it.

Addresses-Coverity-ID: 1468454 ("Infinite loop")
Fixes: faa657641081 ("staging: wilc1000: refactor scan() to free kmalloc memory on failure cases")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Reviewed-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Gustavo A. R. Silva 2018-04-30 07:50:40 -05:00 committed by Greg Kroah-Hartman
parent ba36d10ed1
commit ad109ba137
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
View File

@ -608,7 +608,7 @@ wilc_wfi_cfg_alloc_fill_ssid(struct cfg80211_scan_request *request,
out_free:
for (i = 0; i < slot_id ; i--)
for (i = 0; i < slot_id; i++)
kfree(ntwk->net_info[i].ssid);
kfree(ntwk->net_info);