On Friday 19 August 2022 07:23:43 CEST Dan Carpenter wrote:
> This does a "chunk_len - 4" subtraction later when it calls:
>
> ret = wfx_hif_configuration(wdev, buf + 4, chunk_len - 4);
>
> so check for "chunk_len" is less than 4.
This patch also ensures that buf[4] won't overflow during:
if (buf[4] != '{' || buf[chunk_len - 1] != '}')
dev_warn(wdev->dev, "PDS:%d: unexpected content\n", chunk_num);
> Fixes: dcbecb497908 ("staging: wfx: allow new PDS format")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Reviewed-by: Jérôme Pouiller <jerome.pouiller@xxxxxxxxxx>
--
Jérôme Pouiller
