On 08-09-17 21:13, Kevin Cernekee wrote:
The length of the data in the received skb is currently passed into brcmf_fweh_process_event() as packet_len, but this value is not checked. event_packet should be followed by DATALEN bytes of additional event data. Ensure that the received packet actually contains at least DATALEN bytes of additional data, to avoid copying uninitialized memory into event->data.
Franky made an almost identical change which I had queued up for submission. So you beat us to it ;-)
Reviewed-by: Arend van Spriel <arend.vanspr...@broadcom.com>
Suggested-by: Mattias Nissler <mniss...@chromium.org> Signed-off-by: Kevin Cernekee <cerne...@chromium.org> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
