diff options
| author | Gustavo A. R. Silva <gustavoars@kernel.org> | 2023-08-24 21:10:45 -0600 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2023-09-04 20:16:13 +0300 |
| commit | d5a93b7d2877aae4ba7590ad6cb65f8d33079489 (patch) | |
| tree | f5f7203c3cfb4cd43cdd4e0cacc520874e92b59f /net/wireless | |
| parent | c7847241de28c718285d0e1bd97d1061a4a806c8 (diff) | |
wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
decoding data from `event_buf`.
This prevents any malicious or buggy firmware from overflowing
`event_buf` through large values for `tlv_len` and `tlv_bitmap_len`.
Suggested-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/d4f8780527d551552ee96f17a0229e02e1c200d1.1692931954.git.gustavoars@kernel.org
Diffstat (limited to 'net/wireless')
0 files changed, 0 insertions, 0 deletions