diff options
author | Jussi Kivilinna <jussi.kivilinna@mbnet.fi> | 2009-11-22 13:16:42 -0500 |
---|---|---|
committer | John W. Linville <linville@tuxdriver.com> | 2009-11-23 17:05:40 -0500 |
commit | c1f8ca1d837148bf061d6ffa2038366e3cf0e4d7 (patch) | |
tree | 99fca98ff500fedf95d68a0c6ae3772490d0d9ce /drivers/net/wireless/rndis_wlan.c | |
parent | 841507f5c1a5d2f196afb12e95eb11914f029832 (diff) |
rndis_wlan: fix buffer overflow in rndis_query_oid
rndis_query_oid overwrites *len which stores buffer size to return full size
of received command and then uses *len with memcpy to fill buffer with
command.
Ofcourse memcpy should be done before replacing buffer size.
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/rndis_wlan.c')
-rw-r--r-- | drivers/net/wireless/rndis_wlan.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index aa1880add186..8b09b043bc4e 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c | |||
@@ -733,12 +733,13 @@ static int rndis_query_oid(struct usbnet *dev, __le32 oid, void *data, int *len) | |||
733 | le32_to_cpu(u.get_c->status)); | 733 | le32_to_cpu(u.get_c->status)); |
734 | 734 | ||
735 | if (ret == 0) { | 735 | if (ret == 0) { |
736 | memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len); | ||
737 | |||
736 | ret = le32_to_cpu(u.get_c->len); | 738 | ret = le32_to_cpu(u.get_c->len); |
737 | if (ret > *len) | 739 | if (ret > *len) |
738 | *len = ret; | 740 | *len = ret; |
739 | memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len); | ||
740 | ret = rndis_error_status(u.get_c->status); | ||
741 | 741 | ||
742 | ret = rndis_error_status(u.get_c->status); | ||
742 | if (ret < 0) | 743 | if (ret < 0) |
743 | devdbg(dev, "rndis_query_oid(%s): device returned " | 744 | devdbg(dev, "rndis_query_oid(%s): device returned " |
744 | "error, 0x%08x (%d)", oid_to_string(oid), | 745 | "error, 0x%08x (%d)", oid_to_string(oid), |