github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 06:25:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: wireless: rockchip_wlan: realtek wifi: fix buffer overflow issue in rtw_ioctl_wext_private

Browse Source 
References: CNVD-C-2020-263891
Signed-off-by: Weiguo Hu <hwg@rock-chips.com>
Change-Id: If80c197d9e806a04a14a3a8dbe195942deed46eb
This commit is contained in:
Weiguo Hu 2020-11-17 14:29:34 +08:00 committed by Tao Huang
parent a24abc2faf
commit 3879e152ce
11 changed files with 22 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c
View File

@ -13095,7 +13095,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -13114,7 +13114,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c
View File

@ -13705,7 +13705,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 4096) break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
} while (1);
@ -13723,7 +13723,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 1024) break;
sscanf(str, "%i", &temp);
((s32*)buffer)[count++] = (s32)temp;
} while (1);

4
drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c
View File

@ -13660,7 +13660,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 4096) break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
} while (1);
@ -13678,7 +13678,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 1024) break;
sscanf(str, "%i", &temp);
((s32*)buffer)[count++] = (s32)temp;
} while (1);

4
drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c
View File

@ -12598,7 +12598,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12617,7 +12617,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c
View File

@ -12792,7 +12792,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12811,7 +12811,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c
View File

@ -13586,7 +13586,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 4096) break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
} while (1);
@ -13604,7 +13604,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str) break;
if (NULL == str || count >= 1024) break;
sscanf(str, "%i", &temp);
((s32*)buffer)[count++] = (s32)temp;
} while (1);

4
drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c
View File

@ -12751,7 +12751,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12770,7 +12770,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c
View File

@ -12625,7 +12625,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12644,7 +12644,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c
View File

@ -12613,7 +12613,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12632,7 +12632,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c
View File

@ -12930,7 +12930,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12949,7 +12949,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;

4
drivers/net/wireless/rockchip_wlan/rtl8822bs/os_dep/linux/ioctl_linux.c
View File

@ -12589,7 +12589,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 4096)
break;
sscanf(str, "%i", &temp);
buffer[count++] = (u8)temp;
@ -12608,7 +12608,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
count = 0;
do {
str = strsep(&ptr, delim);
if (NULL == str)
if (NULL == str || count >= 1024)
break;
sscanf(str, "%i", &temp);
((s32 *)buffer)[count++] = (s32)temp;