diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-04-05 13:17:19 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2018-04-25 10:20:36 +0200 |
| commit | 01eca2842874b9a85b7cd1e1b0e5b34a5d53a21f (patch) | |
| tree | bd5fff3b53fc14e87875da3f7c35ce40d779392a /drivers/net/wireless/marvell/mwifiex/pcie.c | |
| parent | mwifiex: uap: support cfg80211 ignore_broadcast_ssid=2 (diff) | |
| download | linux-01eca2842874b9a85b7cd1e1b0e5b34a5d53a21f.tar.xz linux-01eca2842874b9a85b7cd1e1b0e5b34a5d53a21f.zip | |
mwifiex: pcie: tighten a check in mwifiex_pcie_process_event_ready()
If "evt_len" is 1 then we try to memcpy() negative 3 bytes and it would
cause memory corruption.
Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/pcie.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/pcie.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c index 97a6199692ab..7538543d46fa 100644 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c @@ -1881,7 +1881,8 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter) mwifiex_dbg(adapter, EVENT, "info: Event length: %d\n", evt_len); - if ((evt_len > 0) && (evt_len < MAX_EVENT_SIZE)) + if (evt_len > MWIFIEX_EVENT_HEADER_LEN && + evt_len < MAX_EVENT_SIZE) memcpy(adapter->event_body, skb_cmd->data + MWIFIEX_EVENT_HEADER_LEN, evt_len - MWIFIEX_EVENT_HEADER_LEN); |