Skip to content

Commit 918ad13

Browse files
Weiguo Hurkhuangtao
Weiguo Hu
authored and
rkhuangtao
committed
net: wireless: rockchip_wlan: realtek wifi: fix buffer overflow issue in rtw_ioctl_wext_private
References: CNVD-C-2020-263891 Signed-off-by: Weiguo Hu <hwg@rock-chips.com> Change-Id: If80c197d9e806a04a14a3a8dbe195942deed46eb
1 parent 2aa670b commit 918ad13

10 files changed

Lines changed: 20 additions & 20 deletions

File tree

‎drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13095,7 +13095,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1309513095
count = 0;
1309613096
do {
1309713097
str = strsep(&ptr, delim);
13098-
if (NULL == str)
13098+
if (NULL == str || count >= 4096)
1309913099
break;
1310013100
sscanf(str, "%i", &temp);
1310113101
buffer[count++] = (u8)temp;
@@ -13114,7 +13114,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1311413114
count = 0;
1311513115
do {
1311613116
str = strsep(&ptr, delim);
13117-
if (NULL == str)
13117+
if (NULL == str || count >= 1024)
1311813118
break;
1311913119
sscanf(str, "%i", &temp);
1312013120
((s32 *)buffer)[count++] = (s32)temp;

‎drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13705,7 +13705,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1370513705
count = 0;
1370613706
do {
1370713707
str = strsep(&ptr, delim);
13708-
if (NULL == str) break;
13708+
if (NULL == str || count >= 4096) break;
1370913709
sscanf(str, "%i", &temp);
1371013710
buffer[count++] = (u8)temp;
1371113711
} while (1);
@@ -13723,7 +13723,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1372313723
count = 0;
1372413724
do {
1372513725
str = strsep(&ptr, delim);
13726-
if (NULL == str) break;
13726+
if (NULL == str || count >= 1024) break;
1372713727
sscanf(str, "%i", &temp);
1372813728
((s32*)buffer)[count++] = (s32)temp;
1372913729
} while (1);

‎drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13660,7 +13660,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1366013660
count = 0;
1366113661
do {
1366213662
str = strsep(&ptr, delim);
13663-
if (NULL == str) break;
13663+
if (NULL == str || count >= 4096) break;
1366413664
sscanf(str, "%i", &temp);
1366513665
buffer[count++] = (u8)temp;
1366613666
} while (1);
@@ -13678,7 +13678,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1367813678
count = 0;
1367913679
do {
1368013680
str = strsep(&ptr, delim);
13681-
if (NULL == str) break;
13681+
if (NULL == str || count >= 1024) break;
1368213682
sscanf(str, "%i", &temp);
1368313683
((s32*)buffer)[count++] = (s32)temp;
1368413684
} while (1);

‎drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12598,7 +12598,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1259812598
count = 0;
1259912599
do {
1260012600
str = strsep(&ptr, delim);
12601-
if (NULL == str)
12601+
if (NULL == str || count >= 4096)
1260212602
break;
1260312603
sscanf(str, "%i", &temp);
1260412604
buffer[count++] = (u8)temp;
@@ -12617,7 +12617,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1261712617
count = 0;
1261812618
do {
1261912619
str = strsep(&ptr, delim);
12620-
if (NULL == str)
12620+
if (NULL == str || count >= 1024)
1262112621
break;
1262212622
sscanf(str, "%i", &temp);
1262312623
((s32 *)buffer)[count++] = (s32)temp;

‎drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12792,7 +12792,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1279212792
count = 0;
1279312793
do {
1279412794
str = strsep(&ptr, delim);
12795-
if (NULL == str)
12795+
if (NULL == str || count >= 4096)
1279612796
break;
1279712797
sscanf(str, "%i", &temp);
1279812798
buffer[count++] = (u8)temp;
@@ -12811,7 +12811,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1281112811
count = 0;
1281212812
do {
1281312813
str = strsep(&ptr, delim);
12814-
if (NULL == str)
12814+
if (NULL == str || count >= 1024)
1281512815
break;
1281612816
sscanf(str, "%i", &temp);
1281712817
((s32 *)buffer)[count++] = (s32)temp;

‎drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13586,7 +13586,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1358613586
count = 0;
1358713587
do {
1358813588
str = strsep(&ptr, delim);
13589-
if (NULL == str) break;
13589+
if (NULL == str || count >= 4096) break;
1359013590
sscanf(str, "%i", &temp);
1359113591
buffer[count++] = (u8)temp;
1359213592
} while (1);
@@ -13604,7 +13604,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1360413604
count = 0;
1360513605
do {
1360613606
str = strsep(&ptr, delim);
13607-
if (NULL == str) break;
13607+
if (NULL == str || count >= 1024) break;
1360813608
sscanf(str, "%i", &temp);
1360913609
((s32*)buffer)[count++] = (s32)temp;
1361013610
} while (1);

‎drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13077,7 +13077,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1307713077
count = 0;
1307813078
do {
1307913079
str = strsep(&ptr, delim);
13080-
if (NULL == str)
13080+
if (NULL == str || count >= 4096)
1308113081
break;
1308213082
sscanf(str, "%i", &temp);
1308313083
buffer[count++] = (u8)temp;
@@ -13096,7 +13096,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1309613096
count = 0;
1309713097
do {
1309813098
str = strsep(&ptr, delim);
13099-
if (NULL == str)
13099+
if (NULL == str || count >= 1024)
1310013100
break;
1310113101
sscanf(str, "%i", &temp);
1310213102
((s32 *)buffer)[count++] = (s32)temp;

‎drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12625,7 +12625,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1262512625
count = 0;
1262612626
do {
1262712627
str = strsep(&ptr, delim);
12628-
if (NULL == str)
12628+
if (NULL == str || count >= 4096)
1262912629
break;
1263012630
sscanf(str, "%i", &temp);
1263112631
buffer[count++] = (u8)temp;
@@ -12644,7 +12644,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1264412644
count = 0;
1264512645
do {
1264612646
str = strsep(&ptr, delim);
12647-
if (NULL == str)
12647+
if (NULL == str || count >= 1024)
1264812648
break;
1264912649
sscanf(str, "%i", &temp);
1265012650
((s32 *)buffer)[count++] = (s32)temp;

‎drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12613,7 +12613,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1261312613
count = 0;
1261412614
do {
1261512615
str = strsep(&ptr, delim);
12616-
if (NULL == str)
12616+
if (NULL == str || count >= 4096)
1261712617
break;
1261812618
sscanf(str, "%i", &temp);
1261912619
buffer[count++] = (u8)temp;
@@ -12632,7 +12632,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1263212632
count = 0;
1263312633
do {
1263412634
str = strsep(&ptr, delim);
12635-
if (NULL == str)
12635+
if (NULL == str || count >= 1024)
1263612636
break;
1263712637
sscanf(str, "%i", &temp);
1263812638
((s32 *)buffer)[count++] = (s32)temp;

‎drivers/net/wireless/rockchip_wlan/rtl8822be/os_dep/linux/ioctl_linux.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12930,7 +12930,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1293012930
count = 0;
1293112931
do {
1293212932
str = strsep(&ptr, delim);
12933-
if (NULL == str)
12933+
if (NULL == str || count >= 4096)
1293412934
break;
1293512935
sscanf(str, "%i", &temp);
1293612936
buffer[count++] = (u8)temp;
@@ -12949,7 +12949,7 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1294912949
count = 0;
1295012950
do {
1295112951
str = strsep(&ptr, delim);
12952-
if (NULL == str)
12952+
if (NULL == str || count >= 1024)
1295312953
break;
1295412954
sscanf(str, "%i", &temp);
1295512955
((s32 *)buffer)[count++] = (s32)temp;

0 commit comments

Comments
 (0)