mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
authorWen Huang <huangwenabc@gmail.com>
Wed, 28 Aug 2019 02:07:51 +0000 (10:07 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 3 Sep 2019 13:50:21 +0000 (16:50 +0300)
commit7caac62ed598a196d6ddf8d9c121e12e082cac3a
tree926f8c0a3bb5c8cff8ee3a1d5d8a4a85e94e853b
parent70702265a04aa0ce5a7bde77d13456209992b32f
mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings

mwifiex_update_vs_ie(),mwifiex_set_uap_rates() and
mwifiex_set_wmm_params() call memcpy() without checking
the destination size.Since the source is given from
user-space, this may trigger a heap buffer overflow.

Fix them by putting the length check before performing memcpy().

This fix addresses CVE-2019-14814,CVE-2019-14815,CVE-2019-14816.

Signed-off-by: Wen Huang <huangwenabc@gmail.com>
Acked-by: Ganapathi Bhat <gbhat@marvell.comg>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/ie.c
drivers/net/wireless/marvell/mwifiex/uap_cmd.c