From: Dan Carpenter Date: Tue, 28 Jul 2015 15:48:21 +0000 (+0300) Subject: Staging: rtl8192e: array overflow in rtl92e_set_swcam() X-Git-Tag: v4.3-rc1~158^2~289 X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=d1f0f3118e55ad80136d19dd4afdb32ccba26a42;p=karo-tx-linux.git Staging: rtl8192e: array overflow in rtl92e_set_swcam() "EntryNo" is comes from the user in the ioctl and it's a number between 0-255. The ieee->swcamtable[] array only has 32 elements so it can result in memory corruption. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c index dc8c7a86bf93..c146b7e720a9 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c @@ -78,6 +78,10 @@ void rtl92e_set_swcam(struct net_device *dev, u8 EntryNo, u8 KeyIndex, RT_TRACE(COMP_DBG, "===========>%s():EntryNo is %d,KeyIndex is %d,KeyType is %d,is_mesh is %d\n", __func__, EntryNo, KeyIndex, KeyType, is_mesh); + + if (EntryNo >= TOTAL_CAM_ENTRY) + return; + if (!is_mesh) { ieee->swcamtable[EntryNo].bused = true; ieee->swcamtable[EntryNo].key_index = KeyIndex;