Dan Carpenter 260a9ad944 ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() ... The "ext->key_len" is a u16 that comes from the user. If it's over SCM_KEY_LEN (32) that could lead to memory corruption. Fixes: e0d369d1d9 ("[PATCH] ieee82011: Added WE-18 support to default wireless extension handler") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Stanislav Yakovlev <stas.yakovlev@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/YHaoA1i+8uT4ir4h@mwanda		2021-04-17 20:35:44 +03:00
..
ipw2100.c	net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros	2020-09-29 14:02:55 -07:00
ipw2100.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 507	2019-06-19 17:11:23 +02:00
ipw2200.c	ipw2x00: convert tasklets to use new tasklet_setup() API	2020-08-27 16:22:06 +03:00
ipw2200.h	net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros	2020-09-29 14:02:55 -07:00
ipw.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
Kconfig	net: wireless: drop bogus CRYPTO_xxx Kconfig selects	2020-09-11 14:39:16 +10:00
libipw_geo.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 507	2019-06-19 17:11:23 +02:00
libipw_module.c	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
libipw_rx.c	ipw2x00: Use scnprintf() for avoiding potential buffer overflow	2020-03-12 15:43:40 +02:00
libipw_tx.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 507	2019-06-19 17:11:23 +02:00
libipw_wx.c	ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()	2021-04-17 20:35:44 +03:00
libipw.h	net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros	2020-09-29 14:02:55 -07:00
Makefile