wl12xx: fix potential buffer overflow in testmode nvs push
authorLuciano Coelho <coelho@ti.com>
Fri, 1 Apr 2011 16:42:02 +0000 (19:42 +0300)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 14 Apr 2011 20:02:26 +0000 (13:02 -0700)
commit1ff9aebbec267d7a877988df6ced21b95966dda8
tree374100671d95004e0944942c16c90ad71ea2c719
parentdd3e5dee2c55cbb4f8afc54def21554e3e6b48f1
wl12xx: fix potential buffer overflow in testmode nvs push

commit 09b661b33268698d3b453dceb78cda129ad899b4 upstream.

We were allocating the size of the NVS file struct and not checking
whether the length of the buffer passed was correct before copying it
into the allocated memory.  This is a security hole because buffer
overflows can occur if the userspace passes a bigger file than what is
expected.

With this patch, we check if the size of the data passed from
userspace matches the size required.

This bug was introduced in 2.6.36.

Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/net/wireless/wl12xx/testmode.c