mirror of
https://github.com/torvalds/linux.git
synced 2026-05-24 23:22:31 +02:00
staging: rtl8192u: change get_key functions to return 0 instead of -1
Currently, these three get_key functions return -1 when the provided len
value is less a specific key length value, which can result in buffer
overflow depending on how the returned value is used. These functions are
used in three places in ieee80211/ieee80211_wx.c:
ieee80211_wx_get_encode() :
The behavior of this function will be unchanged.
ieee80211_wx_get_encode_ext() :
The result of the get_key function is written to ext->key_len,
resulting in a buffer overflow if the result is negative.
ieee80211_wx_set_encode() :
The behavior of this function will change. When len is less than the
key length value, it will set a default key of all 0.
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Rebecca Mckeever <remckee0@gmail.com>
Link: https://lore.kernel.org/r/Yl/7QPKXer7YtXOs@bertie
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
55de6cb7f8
commit
17c8129e06
|
|
@ -362,7 +362,7 @@ static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv)
|
|||
struct ieee80211_ccmp_data *data = priv;
|
||||
|
||||
if (len < CCMP_TK_LEN)
|
||||
return -1;
|
||||
return 0;
|
||||
|
||||
if (!data->key_set)
|
||||
return 0;
|
||||
|
|
|
|||
|
|
@ -637,7 +637,7 @@ static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv)
|
|||
struct ieee80211_tkip_data *tkey = priv;
|
||||
|
||||
if (len < TKIP_KEY_LEN)
|
||||
return -1;
|
||||
return 0;
|
||||
|
||||
if (!tkey->key_set)
|
||||
return 0;
|
||||
|
|
|
|||
|
|
@ -201,7 +201,7 @@ static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv)
|
|||
struct prism2_wep_data *wep = priv;
|
||||
|
||||
if (len < wep->key_len)
|
||||
return -1;
|
||||
return 0;
|
||||
|
||||
memcpy(key, wep->key, wep->key_len);
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user