linux-kernel - Re: [PATCH] staging: wilc1000: fix incorrect copy of pmkid data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <58CB9FE3.9010708@bfs.de>
Date:   Fri, 17 Mar 2017 09:35:47 +0100
From:   walter harms <wharms@....de>
To:     Colin King <colin.king@...onical.com>
CC:     Aditya Shankar <aditya.shankar@...rochip.com>,
        Ganesh Krishna <ganesh.krishna@...rochip.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-wireless@...r.kernel.org, devel@...verdev.osuosl.org,
        kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: wilc1000: fix incorrect copy of pmkid data



Am 17.03.2017 00:21, schrieb Colin King:
> From: Colin Ian King <colin.king@...onical.com>
> 
> The pmkid data is meant be be copied to the previous item in the
> pmkidlist, however the code is just copying the data to itself because
> the src index into pmkidlist is the same as the dst index into pmkidlist.
> Fix this with i + 1 instead of i.
> 
> Detected by CoverityScan,CID#13339465 ("Overlapping buffer in memory copy")
> 
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/staging/wilc1000/wilc_wfi_cfgoperations.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
> index a37896f..4034f40 100644
> --- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
> +++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
> @@ -1346,7 +1346,7 @@ static int del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
>  			       priv->pmkid_list.pmkidlist[i + 1].bssid,
>  			       ETH_ALEN);
>  			memcpy(priv->pmkid_list.pmkidlist[i].pmkid,
> -			       priv->pmkid_list.pmkidlist[i].pmkid,
> +			       priv->pmkid_list.pmkidlist[i + 1].pmkid,
>  			       PMKID_LEN);
>  		}
>  		priv->pmkid_list.numpmkid--;



perhaps we can also simplify the error handling:
that would reduce the indentlevel by one and effectivly remove the s32Error variable.

if (i >= priv->pmkid_list.numpmkid || priv->pmkid_list.numpmkid <= 0)
	return -EINVAL;


just my 2 cents.
re,
 wh