projects / linux-2.6-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 13ec7f1) | patch
mwifiex: Abort at too short BSS descriptor element
authorTakashi Iwai <tiwai@suse.de>
Wed, 29 May 2019 12:52:20 +0000 (14:52 +0200)
committerKalle Valo <kvalo@codeaurora.org>
Thu, 30 May 2019 11:22:12 +0000 (14:22 +0300)
commit685c9b7750bfacd6fc1db50d86579980593b7869
treeb662ff8b773c688458ac810d1ee67b7e0fcaf829tree | snapshot
parent13ec7f10b87f5fc04c4ccbd491c94c7980236a74commit | diff
mwifiex: Abort at too short BSS descriptor element

Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that
the source descriptor entries contain the enough size for each type
and performs copying without checking the source size.  This may lead
to read over boundary.

Fix this by putting the source size check in appropriate places.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/scan.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)