iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA()

Browse Source 
The pointer math here was totally wrong so we were reading nonsense
information from beyond the end of the buffer.  It could lead to an oops
if that memory wasn't mapped.

The "pReasonCode" pointer is assigned but never used so I deleted it.

With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Tested-by: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2015-07-19 13:52:33 +03:00 committed by Greg Kroah-Hartman
parent 2ee4c3dc55
commit d0dcaa8d4e
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/staging/rtl8192e/rtl819x_BAProc.c
View File

@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
{
struct rtllib_hdr_3addr *delba = NULL;
union delba_param_set *pDelBaParamSet = NULL;
u16 *pReasonCode = NULL;
u8 *dst = NULL;
if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
#endif
delba = (struct rtllib_hdr_3addr *)skb->data;
dst = (u8 *)(&delba->addr2[0]);
delba += sizeof(struct rtllib_hdr_3addr);
pDelBaParamSet = (union delba_param_set *)(delba+2);
pReasonCode = (u16 *)(delba+4);
pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
if (pDelBaParamSet->field.Initiator == 1) {
struct rx_ts_record *pRxTs;