staging: vt6655: buffer overflow in ioctl

->u.generic_elem.len is a user controlled number between 0-255.  We
should limit it to avoid memory corruption.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index f105c2ac091b..164136b07a68 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice,
 {
         PSMgmtObject    pMgmt = pDevice->pMgmt;
 
+        if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))
+                return -EINVAL;
+
         memcpy(pMgmt->abyWPAIE,
                param->u.generic_elem.data,
                param->u.generic_elem.len