Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 055195d2 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "wil6210: potential buffer overflow in wmi_evt_aoa_meas"

parents 13d05423 06c3fa20
Loading
Loading
Loading
Loading
+5 −1
Original line number Diff line number Diff line
/*
 * Copyright (c) 2016, The Linux Foundation. All rights reserved.
 * Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -650,6 +650,10 @@ void wil_aoa_evt_meas(struct wil6210_priv *wil,
	int data_len = len - offsetof(struct wmi_aoa_meas_event, meas_data);
	struct wil_aoa_meas_result *res;

	if (data_len < 0) {
		wil_err(wil, "AOA event too short (%d)\n", len);
		return;
	}
	data_len = min_t(int, le16_to_cpu(evt->length), data_len);

	res = kmalloc(sizeof(*res) + data_len, GFP_KERNEL);