1 files changed, 31 insertions, 16 deletions

diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c
index 6845eb57b39a..653d347a9a19 100644
--- a/drivers/net/wireless/marvell/mwifiex/ie.c
+++ b/drivers/net/wireless/marvell/mwifiex/ie.c
@@ -329,6 +329,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
         struct ieee80211_vendor_ie *vendorhdr;
         u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
         int left_len, parsed_len = 0;
+        unsigned int token_len;
+        int err = 0;
 
         if (!info->tail || !info->tail_len)
                 return 0;
@@ -344,6 +346,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
          */
         while (left_len > sizeof(struct ieee_types_header)) {
                 hdr = (void *)(info->tail + parsed_len);
+                token_len = hdr->len + sizeof(struct ieee_types_header);
+                if (token_len > left_len) {
+                        err = -EINVAL;
+                        goto out;
+                }
+
                 switch (hdr->element_id) {
                 case WLAN_EID_SSID:
                 case WLAN_EID_SUPP_RATES:
@@ -361,17 +369,20 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
                         if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
                                                     WLAN_OUI_TYPE_MICROSOFT_WMM,
                                                     (const u8 *)hdr,
-                                                    hdr->len + sizeof(struct ieee_types_header)))
+                                                    token_len))
                                 break;
                         /* fall through */
                 default:
-                        memcpy(gen_ie->ie_buffer + ie_len, hdr,
-                               hdr->len + sizeof(struct ieee_types_header));
-                        ie_len += hdr->len + sizeof(struct ieee_types_header);
+                        if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len);
+                        ie_len += token_len;
                         break;
                 }
-                left_len -= hdr->len + sizeof(struct ieee_types_header);
-                parsed_len += hdr->len + sizeof(struct ieee_types_header);
+                left_len -= token_len;
+                parsed_len += token_len;
         }
 
         /* parse only WPA vendor IE from tail, WMM IE is configured by
@@ -381,15 +392,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
                                                     WLAN_OUI_TYPE_MICROSOFT_WPA,
                                                     info->tail, info->tail_len);
         if (vendorhdr) {
-                memcpy(gen_ie->ie_buffer + ie_len, vendorhdr,
-                       vendorhdr->len + sizeof(struct ieee_types_header));
-                ie_len += vendorhdr->len + sizeof(struct ieee_types_header);
+                token_len = vendorhdr->len + sizeof(struct ieee_types_header);
+                if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len);
+                ie_len += token_len;
         }
 
-        if (!ie_len) {
-                kfree(gen_ie);
-                return 0;
-        }
+        if (!ie_len)
+                goto out;
 
         gen_ie->ie_index = cpu_to_le16(gen_idx);
         gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
@@ -399,13 +412,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
 
         if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL,
                                          NULL, NULL)) {
-                kfree(gen_ie);
-                return -1;
+                err = -EINVAL;
+                goto out;
         }
 
         priv->gen_idx = gen_idx;
+
+ out:
         kfree(gen_ie);
-        return 0;
+        return err;
 }
 
 /* This function parses different IEs-head & tail IEs, beacon IEs,