mwifiex: Prevent memory corruption handling keys

Browse source

The length of the key comes from the network and it's a 16 bit number.  It
needs to be capped to prevent a buffer overflow.

Fixes: 5e6e3a92b9 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200708115857.GA13729@mwanda

...

This commit is contained in:

Dan Carpenter 2020-07-08 14:58:57 +03:00 • committed by Kalle Valo

parent 9187f4e840

commit e186967865

1 changed files with 15 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c

View file