Skip to content
Commit 3a9b153c authored by Qing Xu's avatar Qing Xu Committed by Kalle Valo
Browse files

mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()



mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: default avatarQing Xu <m1s5p6688@gmail.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 65b1aae0
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment