Skip to content
Commit dd234912 authored by Kevin Cernekee's avatar Kevin Cernekee Committed by Kalle Valo
Browse files

brcmfmac: Add check for short event packets



The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Cc: <stable@vger.kernel.org> # v3.8
Suggested-by: default avatarMattias Nissler <mnissler@chromium.org>
Signed-off-by: default avatarKevin Cernekee <cernekee@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent b8b8b163
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment