Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Verified Commit 660c8c2d authored by android-t1's avatar android-t1 Committed by Ahmed Harhash
Browse files

Integrate security patch 2022-10-05-CVE-2022-20423 

Change-Id: If6d6b1a2f3d6357329761bec9e638bbb93bba0fe
parent cda447c1

drivers/usb/gadget/function/rndis.c

+1 −0
Original line number Diff line number Diff line
@@ -636,6 +636,7 @@ static int rndis_set_response(struct rndis_params *params, 
	BufLength = le32_to_cpu(buf->InformationBufferLength);

	BufOffset = le32_to_cpu(buf->InformationBufferOffset);

	if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||

		(BufOffset > RNDIS_MAX_TOTAL_SIZE) ||

	    (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))

		    return -EINVAL;