linux/drivers/staging/vt6656
Xi Wang 201320435d staging: vt6656: integer overflows in private_ioctl()
There are two potential integer overflows in private_ioctl() if
userspace passes in a large sList.uItem / sNodeList.uItem.  The
subsequent call to kmalloc() would allocate a small buffer, leading
to a memory corruption.

Reported-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-11-30 19:29:40 +09:00
..
80211hdr.h
80211mgr.c staging: vt6656: 80211mgr.c: Code cleanup, removed return of void funcs. 2011-11-30 19:28:18 +09:00
80211mgr.h
aes_ccmp.c
aes_ccmp.h
baseband.c staging: vt6656: baseband.c: Remove commented code 2011-11-30 19:28:18 +09:00
baseband.h
bssdb.c staging: vt6656: baseband.c: Remove commented code 2011-11-30 19:28:18 +09:00
bssdb.h
card.c staging: vt6656: card.c: Change return of CARDbAddBasicRate to void 2011-11-30 19:28:19 +09:00
card.h staging: vt6656: card.c: Change return of CARDbAddBasicRate to void 2011-11-30 19:28:19 +09:00
channel.c
channel.h
control.c
control.h
country.h
datarate.c
datarate.h
desc.h
device.h vt6656: Use request_firmware() to load firmware 2011-01-21 12:19:11 -08:00
device_cfg.h
dpc.c staging: vt6656: use %pM for printing MACs 2011-08-23 14:36:18 -07:00
dpc.h
firmware.c staging: vt6656: Remove NULL check before kfree 2011-03-14 11:57:37 -07:00
firmware.h
hostap.c staging: vt6656: Remove NULL check before kfree 2011-03-14 11:57:37 -07:00
hostap.h
int.c
int.h
iocmd.h
ioctl.c staging: vt6656: integer overflows in private_ioctl() 2011-11-30 19:29:40 +09:00
ioctl.h
iowpa.h
iwctl.c staging:vt6656: iwctl.c: Removed unneeded function 2011-11-30 19:25:50 +09:00
iwctl.h staging:vt6656: iwctl.c: Removed unneeded function 2011-11-30 19:25:50 +09:00
Kconfig Staging: vt665?: prevent modules from being built into the kernel. 2011-04-04 21:33:26 -07:00
key.c
key.h
mac.c
mac.h
main_usb.c staging: vt6656: main_usb.c: Use kzalloc instead kmalloc 2011-11-30 19:28:18 +09:00
Makefile
mib.c
mib.h
michael.c
michael.h
power.c Staging: vt6656: Clean up switching to power saving mode. 2011-03-02 15:52:30 -05:00
power.h
rc4.c
rc4.h
rf.c
rf.h
rndis.h
rxtx.c staging: Remove unnecessary semicolons when if (foo) {...}; 2011-04-25 16:58:34 -07:00
rxtx.h
srom.h
tcrc.c
tcrc.h
tether.c
tether.h
tkip.c staging: vt6656 resolved parenthesis not spaces 2010-11-09 15:55:54 -08:00
tkip.h
tmacro.h
TODO
ttype.h
upc.h
usbpipe.c
usbpipe.h
vntconfiguration.dat
wcmd.c staging: Remove unnecessary semicolons when if (foo) {...}; 2011-04-25 16:58:34 -07:00
wcmd.h
wctl.c
wctl.h
wmgr.c staging: vt6656: use %pM for printing MACs 2011-08-23 14:36:18 -07:00
wmgr.h Fix common misspellings 2011-03-31 11:26:23 -03:00
wpa.c
wpa.h
wpa2.c drivers/staging: Remove unnecessary semicolons 2010-11-16 12:06:47 -08:00
wpa2.h
wpactl.c Staging: vt6656: potential memory corruption 2011-09-29 17:34:50 -07:00
wpactl.h