Search Linux Wireless

Re: [PATCH 1/3] brcmfmac: Avoid possible out-of-bounds read

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 08-09-17 21:13, Kevin Cernekee wrote:
In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
the length of rxframe is validated.  This could lead to uninitialized
data being printed in a debug message.  Since we already have a

The debug message is after the length validation so there is not unintialized data being printed.

perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
and ch.chspec is not modified by decchspec(), avoid the extra
assignment and use ch.chspec in the debug print.

However, there is no real for the chanspec variable for the given reason so...

Reviewed-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
Suggested-by: Mattias Nissler <mnissler@xxxxxxxxxxxx>
Signed-off-by: Kevin Cernekee <cernekee@xxxxxxxxxxxx>
---
  drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +--
  1 file changed, 1 insertion(+), 2 deletions(-)



[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux