diff options
| author | Patrick Tjin <pattjin@google.com> | 2016-02-11 13:20:44 -0800 |
|---|---|---|
| committer | Kees Cook <keescook@google.com> | 2016-03-10 10:36:40 -0800 |
| commit | b24ed15b1ec4331ec8f32edf1a8124a19de25a17 (patch) | |
| tree | 81824e006efa72e537b0d4b824579b29a0ddd232 | |
| parent | 52e10a970f364844a49fc6ea7bf34920b835e093 (diff) | |
| download | minnowboard-v3.14-b24ed15b1ec4331ec8f32edf1a8124a19de25a17.tar.gz | |
net: wireless: bcmdhd: Do not print out device name on invalid length
(cherry picked from commit b149dd5d22c3e4c2faab0bb934a018888ff99ef3)
Signed-off-by: Patrick Tjin <pattjin@google.com>
Bug: 27335848
[fixes CVE-2016-0801]
Signed-off-by: Kees Cook <keescook@chromium.org>
Change-Id: I04297d425d6422b2d5d5e4ffbf07328758a270c7
| -rw-r--r-- | drivers/net/wireless/bcmdhd/wl_cfg80211.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c index ed2ebf50e8d..077e10c4cd1 100644 --- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c +++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c @@ -1157,10 +1157,12 @@ wl_validate_wps_ie(char *wps_ie, s32 wps_ie_len, bool *pbc) } else if (subelt_id == WPS_ID_DEVICE_NAME) { char devname[100]; size_t namelen = MIN(subelt_len, sizeof(devname)); - memcpy(devname, subel, namelen); - devname[namelen-1] = '\0'; - WL_DBG((" attr WPS_ID_DEVICE_NAME: %s (len %u)\n", - devname, subelt_len)); + if (namelen) { + memcpy(devname, subel, namelen); + devname[namelen - 1] = '\0'; + WL_DBG((" attr WPS_ID_DEVICE_NAME: %s (len %u)\n", + devname, subelt_len)); + } } else if (subelt_id == WPS_ID_DEVICE_PWD_ID) { valptr[0] = *subel; valptr[1] = *(subel + 1); |