A crafted nvs file could trick the driver into reading and writing beyond end of buffers. Pontus Fuchs (2): wl12xx: Validate FEM index from ini file and FW wl12xx: Check buffer bound when processing nvs data drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++ drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++ 2 files changed, 36 insertions(+), 0 deletions(-) -- 1.7.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
