diff options
| -rw-r--r-- | drivers/staging/ath6kl/os/linux/ioctl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/staging/ath6kl/os/linux/ioctl.c b/drivers/staging/ath6kl/os/linux/ioctl.c index 82c7611c208..4f30b255fc1 100644 --- a/drivers/staging/ath6kl/os/linux/ioctl.c +++ b/drivers/staging/ath6kl/os/linux/ioctl.c @@ -3175,6 +3175,11 @@ int ar6000_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) break; } + if (optTxFrmCmd.optIEDataLen > MAX_OPT_DATA_LEN) { + ret = -EINVAL; + break; + } + if (copy_from_user(data, userdata+sizeof(WMI_OPT_TX_FRAME_CMD) - 1, optTxFrmCmd.optIEDataLen)) { ret = -EFAULT; |