]> git.baikalelectronics.ru Git - kernel.git/commit
mwifiex: fix invalid memory access in mwifiex_get_power_level()
authorAmitkumar Karwar <akarwar@marvell.com>
Tue, 22 Oct 2013 22:24:44 +0000 (15:24 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 11 Nov 2013 19:38:56 +0000 (14:38 -0500)
commitd22f5f51efe0a6ddf699969b58eb254f5f53f6d7
tree5bb5700952ca24730ebd1f253353290d38a29b0e
parent60d4dec54227fd69df4e5d6368151bd2202caed2
mwifiex: fix invalid memory access in mwifiex_get_power_level()

With "while (length)" check we may end up in accessing invalid
memory in last iteration.
This patch makes sure that tlv length is not less than the length
of structure mwifiex_power_group when min/max power is calculated.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/mwifiex/sta_cmdresp.c