diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-08-13 17:13:15 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2020-08-17 13:22:08 +0300 |
| commit | 54f9ab7b870934b70e5a21786d951fbcf663970f (patch) | |
| tree | a0191fb94cf24f653beee5b0a5010826edef5202 | |
| parent | 42f5fe34a701769763c299c49a89595e60871dcf (diff) | |
ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
The value for "aid" comes from skb->data so Smatch marks it as
untrusted. If it's invalid then it can result in an out of bounds array
access in ath6kl_add_new_sta().
Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/main.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c index 210218298e13..d3aa9e7a37c2 100644 --- a/drivers/net/wireless/ath/ath6kl/main.c +++ b/drivers/net/wireless/ath/ath6kl/main.c @@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); + if (aid < 1 || aid > AP_MAX_NUM_STA) + return; + if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) assoc_info; |