]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
UBUNTU: SAUCE: rtlwifi: Fix potential overflow on P2P code
authorTyler Hicks <tyhicks@canonical.com>
Fri, 18 Oct 2019 07:13:00 +0000 (09:13 +0200)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Mon, 21 Oct 2019 14:31:08 +0000 (16:31 +0200)
commit2e688883532406b652fc72f4eeacc94089f76146
tree73516a4eade495bae0b9748d1cf9decdd9440cb6
parent3163c3e734d7976f2e5ed5d86b41b7b4bb4e7412
UBUNTU: SAUCE: rtlwifi: Fix potential overflow on P2P code

Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bounds check noa_num against P2P_MAX_NOA_NUM using the minimum of the
two.

CVE-2019-17666

Reported-by: Nicolas Waisman <nico@semmle.com>
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
[tyhicks: Reuse nearly all of a commit message written by Laura Abbott]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
drivers/net/wireless/realtek/rtlwifi/ps.c