mirror of
https://github.com/torvalds/linux.git
synced 2026-10-17 14:30:03 +02:00
ce67ebe9d8
wfx_hif_read_mib() copies reply->length bytes from the firmware
response into the caller-provided buffer without checking that
reply->length does not exceed val_len. A firmware response with
a length field larger than expected overruns the caller buffer and
reads past the end of the reply allocation.
Replace the dead -ENOMEM check with an active validation that
reply->length fits within val_len before the memcpy.
Fixes:
|
||
|---|---|---|
| .. | ||
| bh.c | ||
| bh.h | ||
| bus_sdio.c | ||
| bus_spi.c | ||
| bus.h | ||
| data_rx.c | ||
| data_rx.h | ||
| data_tx.c | ||
| data_tx.h | ||
| debug.c | ||
| debug.h | ||
| fwio.c | ||
| fwio.h | ||
| hif_api_cmd.h | ||
| hif_api_general.h | ||
| hif_api_mib.h | ||
| hif_rx.c | ||
| hif_rx.h | ||
| hif_tx_mib.c | ||
| hif_tx_mib.h | ||
| hif_tx.c | ||
| hif_tx.h | ||
| hwio.c | ||
| hwio.h | ||
| Kconfig | ||
| key.c | ||
| key.h | ||
| main.c | ||
| main.h | ||
| Makefile | ||
| queue.c | ||
| queue.h | ||
| scan.c | ||
| scan.h | ||
| sta.c | ||
| sta.h | ||
| traces.h | ||
| wfx.h | ||