Messages in this thread Patch in this message | | | From | Matteo Semenzato <> | Subject | [PATCH] Staging: rtl8188eu fix buffer overflow | Date | Fri, 20 Mar 2015 15:21:40 +0100 |
| |
From: Matteo Semenzato <mattew8898@gmail.com>
This patch fixes the buffer overflow caused by accessing index 4 of hwxmits.
Signed-off-by: Matteo Semenzato <mattew8898@gmail.com> --- drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c index 7a71df1..7b22779 100644 --- a/drivers/staging/rtl8188eu/core/rtw_xmit.c +++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c @@ -1631,10 +1631,12 @@ void rtw_alloc_hwxmits(struct adapter *padapter) { struct hw_xmit *hwxmits; struct xmit_priv *pxmitpriv = &padapter->xmitpriv; + size_t size; pxmitpriv->hwxmit_entry = HWXMIT_ENTRY; - pxmitpriv->hwxmits = kzalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry, GFP_KERNEL); + size = sizeof(struct hw_xmit) * (pxmitpriv->hwxmit_entry + 1); + pxmitpriv->hwxmits = kzalloc(size, GFP_KERNEL); hwxmits = pxmitpriv->hwxmits; -- 2.3.2
| |