wil6210: check len before memcpy() calls
authorDenis Efremov <efremov@linux.com>
Tue, 1 Oct 2019 12:08:23 +0000 (15:08 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 17 Dec 2019 19:07:47 +0000 (20:07 +0100)
commitf94b7a436d64bb16568cdc70dc729042164cf17d
treec95b1082bab99deae6b48c9a227cca1c14fd4f3d
parent9e473f472a38bd53f73ad1b12ebc179a15f4ab8f
wil6210: check len before memcpy() calls

commit 2c840676be8ffc624bf9bb4490d944fd13c02d71 upstream.

memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with
src == NULL and len == 0. This is an undefined behavior. Fix it
by checking "ie_len > 0" before the memcpy() calls.

As suggested by GCC documentation:
"The pointers passed to memmove (and similar functions in <string.h>)
must be non-null even when nbytes==0, so GCC can use that information
to remove the check after the memmove call." [1]

[1] https://gcc.gnu.org/gcc-4.9/porting_to.html

Cc: Maya Erez <merez@codeaurora.org>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: stable@vger.kernel.org
Signed-off-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/ath/wil6210/wmi.c