rt2x00: fix possible memory corruption in case of invalid rxdesc.size
authorStanislaw Gruszka <stf_xl@wp.pl>
Sun, 19 Jun 2011 17:46:02 +0000 (19:46 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 22 Jun 2011 20:09:44 +0000 (16:09 -0400)
Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

No differences found