Search Linux Wireless

Re: [PATCH 3/3] brcmfmac: Add check for short event packets

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 08-09-17 21:13, Kevin Cernekee wrote:
The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Franky made an almost identical change which I had queued up for submission. So you beat us to it ;-)

Reviewed-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
Suggested-by: Mattias Nissler <mnissler@xxxxxxxxxxxx>
Signed-off-by: Kevin Cernekee <cernekee@xxxxxxxxxxxx>
---
  drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)



[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux