mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

Browse source

mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

...

This commit is contained in:

Qing Xu 2020-01-02 10:39:26 +08:00 • committed by Kalle Valo

parent 65b1aae0d9

commit 3a9b153c55

1 changed files with 4 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

drivers/net/wireless/marvell/mwifiex/wmm.c

View file