]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2eb45f4) | patch
mwifiex: fix probable memory corruption while processing TDLS frame
authorAvinash Patil <patila@marvell.com>
Fri, 12 Sep 2014 14:38:46 +0000 (20:08 +0530)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 15 Sep 2014 19:00:50 +0000 (15:00 -0400)
commitda7abf75d802d3e728bbce89831080bfb7179cd5
tree2df41a172c90417e2175dcc424f94d3f86a7df37tree | snapshot
parent2eb45f4f4f6c7d9a30101eca97ae40941a793e17commit | diff
mwifiex: fix probable memory corruption while processing TDLS frame

Size of RSN IE buffer in driver is 254 while maximum size of received buffer
to be copied to RSN IE buffer can be 255. Add boundary check to copy maximum
of 254 bytes into RSN IE buffer.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/mwifiex/tdls.c diff | blob | history
Linux Kernel Source Tree.