DivestOS/Patches/Linux_CVEs/CVE-2016-0801/ANY/0001.patch
2017-11-07 17:32:46 -05:00

29 lines
1.2 KiB
Diff

diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
index e9eb33d..f2ba9c8 100644
--- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c
+++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
@@ -1173,8 +1173,9 @@
WL_DBG((" attr WPS_ID_CONFIG_METHODS: %x\n", HTON16(val)));
} else if (subelt_id == WPS_ID_DEVICE_NAME) {
char devname[100];
- memcpy(devname, subel, subelt_len);
- devname[subelt_len] = '\0';
+ size_t namelen = MIN(subelt_len, sizeof(devname));
+ memcpy(devname, subel, namelen);
+ devname[namelen-1] = '\0';
WL_DBG((" attr WPS_ID_DEVICE_NAME: %s (len %u)\n",
devname, subelt_len));
} else if (subelt_id == WPS_ID_DEVICE_PWD_ID) {
@@ -9678,9 +9679,9 @@
* scan request in the form of cfg80211_scan_request. For timebeing, create
* cfg80211_scan_request one out of the received PNO event.
*/
+ ssid[i].ssid_len = MIN(DOT11_MAX_SSID_LEN, netinfo->pfnsubnet.SSID_len);
memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID,
- netinfo->pfnsubnet.SSID_len);
- ssid[i].ssid_len = netinfo->pfnsubnet.SSID_len;
+ ssid[i].ssid_len);
request->n_ssids++;
channel_req = netinfo->pfnsubnet.channel;