mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
mwifiex_update_vs_ie(),mwifiex_set_uap_rates() and mwifiex_set_wmm_params() call memcpy() without checking the destination size.Since the source is given from user-space, this may trigger a heap buffer overflow. Fix them by putting the length check before performing memcpy(). This fix addresses CVE-2019-14814,CVE-2019-14815,CVE-2019-14816. Signed-off-by: NWen Huang <huangwenabc@gmail.com> Acked-by: NGanapathi Bhat <gbhat@marvell.comg> Signed-off-by: NKalle Valo <kvalo@codeaurora.org>
Showing
想要评论请 注册 或 登录