struct hfa384x_wpa_data ends with a flexible array, but it is allocated
on the stack. This means it can never hold any data. Disable the
memcpy() calls in and out of the structure, since it must always be
zero. This could never have worked.
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: Igor Matheus Andrade Torrente <igormtorrente@xxxxxxxxx>
Cc: linux-staging@xxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
drivers/staging/wlan-ng/prism2mib.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/staging/wlan-ng/prism2mib.c b/drivers/staging/wlan-ng/prism2mib.c
index 875812a391c9..d14f032a7ed6 100644
--- a/drivers/staging/wlan-ng/prism2mib.c
+++ b/drivers/staging/wlan-ng/prism2mib.c
@@ -668,6 +668,10 @@ static int prism2mib_priv(struct mibrec *mib,
switch (mib->did) {
case DIDMIB_LNX_CONFIGTABLE_RSNAIE: {
+ /*
+ * This can never work: wpa is on the stack
+ * and has no bytes allocated in wpa.data.
+ */
struct hfa384x_wpa_data wpa;
if (isget) {
@@ -675,11 +679,17 @@ static int prism2mib_priv(struct mibrec *mib,
HFA384x_RID_CNFWPADATA,
(u8 *)&wpa,
sizeof(wpa));
+ /*
pstr->len = le16_to_cpu(wpa.datalen);
memcpy(pstr->data, wpa.data, pstr->len);
+ */
+ pstr->len = 0;
} else {
+ /*
wpa.datalen = cpu_to_le16(pstr->len);
memcpy(wpa.data, pstr->data, pstr->len);
+ */
+ wpa.datalen = 0;
hfa384x_drvr_setconfig(hw,
HFA384x_RID_CNFWPADATA,
--
2.30.2
