Searched hist:d5a93b7d2877aae4ba7590ad6cb65f8d33079489 (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/drivers/net/wireless/marvell/mwifiex/ |
| H A D | 11n_rxreorder.c | diff d5a93b7d2877aae4ba7590ad6cb65f8d33079489 Thu Aug 24 22:10:45 CDT 2023 Gustavo A. R. Silva <gustavoars@kernel.org> wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
decoding data from `event_buf`.
This prevents any malicious or buggy firmware from overflowing
`event_buf` through large values for `tlv_len` and `tlv_bitmap_len`.
Suggested-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/d4f8780527d551552ee96f17a0229e02e1c200d1.1692931954.git.gustavoars@kernel.org
|