diff options
| author | Dan Carpenter <[email protected]> | 2012-03-01 10:02:08 +0300 |
|---|---|---|
| committer | John W. Linville <[email protected]> | 2012-03-05 15:23:15 -0500 |
| commit | 41eedf39dfb145fb8fa04cd5b799f7bdc7679696 (patch) | |
| tree | 359897e247fc8112046abae3540759eea33213e2 /include/linux/kernel.h | |
| parent | 5533513784a88049e19dd2ab380a452b61e5171e (diff) | |
rndis_wlan: integer overflows in rndis_wlan_do_link_up_work()
If "offset" is negative then we can get past this check:
if (offset > CONTROL_BUFFER_SIZE)
Or if we pick a very high "req_ie_len" then we can get around the check:
if (offset + req_ie_len > CONTROL_BUFFER_SIZE)
I made "resp_ie_len" and "req_ie_len" unsigned. I don't know if it was
intentional that they were signed in the original.
Signed-off-by: Dan Carpenter <[email protected]>
Acked-by: Jussi Kivilinna <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Diffstat (limited to 'include/linux/kernel.h')
0 files changed, 0 insertions, 0 deletions