Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit dd234912 authored by Kevin Cernekee's avatar Kevin Cernekee Committed by Kalle Valo
Browse files

brcmfmac: Add check for short event packets



The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Cc: <stable@vger.kernel.org> # v3.8
Suggested-by: default avatarMattias Nissler <mnissler@chromium.org>
Signed-off-by: default avatarKevin Cernekee <cernekee@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent b8b8b163
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment