wil6210: fix length check in __wmi_send
The current length check: sizeof(cmd) + len > r->entry_size will allow very large values of len (> U16_MAX - sizeof(cmd)) and can cause a buffer overflow. Fix the check to cover this case. In addition, ensure the mailbox entry_size is not too small, since this can also bypass the above check. Change-Id: Iecb4f53ef05da0e015bc954b57b0e40debb7c8b7 Signed-off-by:Lior David <liord@codeaurora.org> Signed-off-by:
Hamad Kadmany <hkadmany@codeaurora.org>
Loading
Please register or sign in to comment