2014-02-14 09:03:35

by Dan Carpenter

Subject: [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()

There is a typo here because the names are confusingly similar. The
intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
ieee80211_ht_cap) (size 32) was used.

Anway, it's cleaner to just specify the variable instead of the type.

Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
Signed-off-by: Dan Carpenter <[email protected]>

diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 5efd456af571..9d6849f60603 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));

mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
- memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap));
+ memcpy(pos, &vht_cap, sizeof(vht_cap));

return 0;
}

2014-02-15 03:02:31

by Bing Zhao

Subject: RE: [patch] mwifiex: memory corruption in mwifiex_tdls_add_vht_capab()

Hi Dan,

Thanks for the patch.

> There is a typo here because the names are confusingly similar. The
> intent was sizeof(struct ieee80211_vht_cap) (size 12) but sizeof(struct
> ieee80211_ht_cap) (size 32) was used.
>
> Anway, it's cleaner to just specify the variable instead of the type.
>
> Fixes: 5f6d5983394f ('mwifiex: add VHT support for TDLS')
> Signed-off-by: Dan Carpenter <[email protected]>

Acked-by: Bing Zhao <[email protected]>

Thanks,
Bing

>
> diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
> index 5efd456af571..9d6849f60603 100644
> --- a/drivers/net/wireless/mwifiex/tdls.c
> +++ b/drivers/net/wireless/mwifiex/tdls.c
> @@ -180,7 +180,7 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
> memset(&vht_cap, 0, sizeof(struct ieee80211_vht_cap));
>
> mwifiex_fill_vht_cap_tlv(priv, &vht_cap, priv->curr_bss_params.band);
> - memcpy(pos, &vht_cap, sizeof(struct ieee80211_ht_cap));
> + memcpy(pos, &vht_cap, sizeof(vht_cap));
>
> return 0;
> }