Linux-Wireless Archive on
 help / color / Atom feed
From: Kalle Valo <>
To: Takashi Iwai <>
Cc: Amitkumar Karwar <>,
	Nishant Sarmukadam <>,
	Ganapathi Bhat <>,
	Xinming Hu <>,
	huangwen <>,
	Solar Designer <>,
	Marcus Meissner <>,
Subject: Re: [PATCH] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
Date: Sat,  1 Jun 2019 05:06:46 +0000 (UTC)
Message-ID: <> (raw)
In-Reply-To: <>

Takashi Iwai <> wrote:

> A few places in mwifiex_uap_parse_tail_ies() perform memcpy()
> unconditionally, which may lead to either buffer overflow or read over
> boundary.
> This patch addresses the issues by checking the read size and the
> destination size at each place more properly.  Along with the fixes,
> the patch cleans up the code slightly by introducing a temporary
> variable for the token size, and unifies the error path with the
> standard goto statement.
> Reported-by: huangwen <>
> Signed-off-by: Takashi Iwai <>

Patch applied to wireless-drivers.git, thanks.

69ae4f6aac15 mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()


      reply index

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-31 13:18 Takashi Iwai
2019-06-01  5:06 ` Kalle Valo [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Wireless Archive on

Archives are clonable:
	git clone --mirror linux-wireless/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-wireless linux-wireless/ \
	public-inbox-index linux-wireless

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone