Dan Carpenter <[email protected]> wrote: > If recvlength is less than MESSAGE_HEADER_LEN (4) we would end up > corrupting memory. > > Fixes: c305a19a0d0a ("libertas_tf: usb specific functions") > Signed-off-by: Dan Carpenter <[email protected]>
Patch applied to wireless-drivers-next.git, thanks. 3348ef6a6a12 libertas_tf: prevent underflow in process_cmdrequest() -- https://patchwork.kernel.org/patch/10565197/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
