tree b3914370cf19ca0124090ce60de504d7f5e29f84
parent 5dd5ae04fd2393894d8f4ca7b95a2b54ca93d931
author Will Deacon <will@kernel.org> 1570182692 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1572336921 +0100

cfg80211: wext: avoid copying malformed SSIDs

commit 4ac2813cc867ae563a1ba5a9414bfb554e5796fa upstream.

Ensure the SSID element is bounds-checked prior to invoking memcpy()
with its length field, when copying to userspace.

Cc: <stable@vger.kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20191004095132.15777-2-will@kernel.org
[adjust commit log a bit]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>