lkml.org 
[lkml]   [2015]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 2/2 v2] Staging: rtl8192e: pointer math bug in rtllib_rx_DELBA()
On 19.07.2015 12:52, Dan Carpenter wrote:
> The pointer math here was totally wrong so we were reading nonsense
> information from beyond the end of the buffer. It could lead to an oops
> if that memory wasn't mapped.
>
> The "pReasonCode" pointer is assigned but never used so I deleted it.
>
> With-Fix-From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Mateusz noticed some more pointer math bugs on the next lines.
>
> diff --git a/drivers/staging/rtl8192e/rtl819x_BAProc.c b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> index 60f536c..78ede4a 100644
> --- a/drivers/staging/rtl8192e/rtl819x_BAProc.c
> +++ b/drivers/staging/rtl8192e/rtl819x_BAProc.c
> @@ -428,7 +428,6 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> {
> struct rtllib_hdr_3addr *delba = NULL;
> union delba_param_set *pDelBaParamSet = NULL;
> - u16 *pReasonCode = NULL;
> u8 *dst = NULL;
>
> if (skb->len < sizeof(struct rtllib_hdr_3addr) + 6) {
> @@ -453,9 +452,7 @@ int rtllib_rx_DELBA(struct rtllib_device *ieee, struct sk_buff *skb)
> #endif
> delba = (struct rtllib_hdr_3addr *)skb->data;
> dst = (u8 *)(&delba->addr2[0]);
> - delba += sizeof(struct rtllib_hdr_3addr);
> - pDelBaParamSet = (union delba_param_set *)(delba+2);
> - pReasonCode = (u16 *)(delba+4);
> + pDelBaParamSet = (union delba_param_set *)&delba->payload[2];
>
> if (pDelBaParamSet->field.Initiator == 1) {
> struct rx_ts_record *pRxTs;
>

Acked/Tested-by me

Thanks,
Mateusz


\
 
 \ /
  Last update: 2015-07-19 20:41    [W:0.034 / U:2.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site