mwifiex: fix probable memory corruption while processing TDLS frame

Browse source

Size of RSN IE buffer in driver is 254 while maximum size of received buffer
to be copied to RSN IE buffer can be 255. Add boundary check to copy maximum
of 254 bytes into RSN IE buffer.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

...

This commit is contained in:

Avinash Patil 2014-09-12 20:08:46 +05:30 • committed by John W. Linville

parent 4721c63b92

commit 3c99832d74

1 changed files with 3 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

drivers/net/wireless/mwifiex/tdls.c

View file