github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-29 10:41:49 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: iwlwifi: mld: don't parse a notif before checking its length

Browse Source 
In order to compure the size of the iwl_mcc_update_resp which has a
variable length, we need to know the number of channels.
In order to read the number of channels, we must first check the
payload is long enough to read at least that.

Add this check.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.c2f644919011.Ic579e9935b92a674c96ccc44713140b5b4bc5d10@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
This commit is contained in:
Emmanuel Grumbach 2026-07-14 14:19:53 +03:00 committed by Miri Korenblit
parent 402620cdcf
commit 119c353467
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/wireless/intel/iwlwifi/mld/mcc.c
View File

@ -18,9 +18,15 @@ static struct iwl_mcc_update_resp_v8 *
iwl_mld_copy_mcc_resp(const struct iwl_rx_packet *pkt)
{
const struct iwl_mcc_update_resp_v8 *mcc_resp_v8 = (const void *)pkt->data;
int n_channels = __le32_to_cpu(mcc_resp_v8->n_channels);
struct iwl_mcc_update_resp_v8 *resp_cp;
int notif_len = struct_size(resp_cp, channels, n_channels);
int n_channels;
int notif_len;
if (iwl_rx_packet_payload_len(pkt) < sizeof(*mcc_resp_v8))
return ERR_PTR(-EINVAL);
n_channels = __le32_to_cpu(mcc_resp_v8->n_channels);
notif_len = struct_size(resp_cp, channels, n_channels);
if (iwl_rx_packet_payload_len(pkt) != notif_len)
return ERR_PTR(-EINVAL);