tree 33c71c73da165d47b2d059311cce4a00dbf70bbb
parent 9c803a03bc07553f8148d024c15c784b28c1d9ee
author Stanislaw Gruszka <stf_xl@wp.pl> 1308505562 +0200
committer John W. Linville <linville@tuxdriver.com> 1308773384 -0400

rt2x00: fix possible memory corruption in case of invalid rxdesc.size

Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>