mwifiex: fix invalid memory access in mwifiex_get_power_level()

Browse source

With "while (length)" check we may end up in accessing invalid
memory in last iteration.
This patch makes sure that tlv length is not less than the length
of structure mwifiex_power_group when min/max power is calculated.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

...

This commit is contained in:

Amitkumar Karwar 2013-10-22 15:24:44 -07:00 • committed by John W. Linville

parent 930fd35c8d

commit fe1c9a443e

1 changed files with 12 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/net/wireless/mwifiex/sta_cmdresp.c

View file