Larry Finger 499c405b2b staging: rtl8188eu: Fix potential security hole ... In routine rtw_hostapd_ioctl(), the user-controlled p->length is assumed to be at least the size of struct ieee_param size, but this assumption is never checked. This could result in out-of-bounds read/write on kernel heap in case a p->length less than the size of struct ieee_param is specified by the user. If p->length is allowed to be greater than the size of the struct, then a malicious user could be wasting kernel memory. Fixes commit a2c60d42d9 ("Add files for new driver - part 16"). Reported by: Pietro Oliva <pietroliva@gmail.com> Cc: Pietro Oliva <pietroliva@gmail.com> Cc: Stable <stable@vger.kernel.org> Fixes: a2c60d42d9 ("staging: r8188eu: Add files for new driver - part 16") Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Link: https://lore.kernel.org/r/20200210180235.21691-2-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-10 10:32:31 -08:00
..
core	staging: rtl8188eu: remove else after break or return	2020-01-22 09:44:44 +01:00
hal	staging: rtl8188eu: remove else after break or return	2020-01-22 09:44:44 +01:00
include	staging: rtl8188eu: remove unused enum and defines	2020-01-22 09:44:44 +01:00
os_dep	staging: rtl8188eu: Fix potential security hole	2020-02-10 10:32:31 -08:00
Kconfig	staging: rtl8188eu: use help instead of ---help--- in Kconfig	2019-05-20 10:49:07 +02:00
Makefile	staging: rtl8188eu: rename odm_HWConfig	2018-10-02 15:20:40 -07:00
TODO	staging: rtl8188eu: Fix spelling mistake	2018-08-27 19:29:39 +02:00