wext: verify buffer size for SIOCSIWENCODEEXT

[linux-block.git] / net / wireless / wext.c

diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index cb6a5bb85d802ca90cdf111451fe6b109ac08f26..0e59f9ae9b81fadcff031f044a2b1bfa14e21d3c 100644 (file)
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -786,6 +786,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                        err = -EFAULT;
                        goto out;
                }
+
+               if (cmd == SIOCSIWENCODEEXT) {
+                       struct iw_encode_ext *ee = (void *) extra;
+
+                       if (iwp->length < sizeof(*ee) + ee->key_len)
+                               return -EFAULT;
+               }
        }
 
        err = handler(dev, info, (union iwreq_data *) iwp, extra);