hak5/wifipineapple-openwrt
1
0
Fork 0
mirror of https://github.com/hak5/wifipineapple-openwrt.git synced 2025-10-29 16:57:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

b53: fix memory out of bounds access on 64 bit targets

Browse Source 
On device reset the sizes for the vlan and port tables were wrongly
calculated based on the pointer size instead of the struct size. This
causes buffer overruns on 64 bit targets, resulting in panics.

Fix this by dereferencing the pointers.

Reported-by: Fedor Konstantinov <blmink@mink.su>
Signed-off-by: Jonas Gorski <jogo@openwrt.org>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@45938 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
Jonas Gorski
2015-06-10 09:21:36 +00:00
parent 101fe68b5a
commit fed4eb49f0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
target/linux/generic/files/drivers/net/phy/b53/b53_common.c
View File

@@ -803,8 +803,8 @@ static int b53_global_reset_switch(struct switch_dev *dev)
priv->enable_jumbo = 0;
priv->allow_vid_4095 = 0;
memset(priv->vlans, 0, sizeof(priv->vlans) * dev->vlans);
memset(priv->ports, 0, sizeof(priv->ports) * dev->ports);
memset(priv->vlans, 0, sizeof(*priv->vlans) * dev->vlans);
memset(priv->ports, 0, sizeof(*priv->ports) * dev->ports);
return b53_switch_reset(priv);
}