Re: [PATCH v2] rtlwifi: Fix potential overflow on P2P code

2019-10-23 Thread Kalle Valo
Laura Abbott wrote: > Nicolas Waisman noticed that even though noa_len is checked for > a compatible length it's still possible to overrun the buffers > of p2pinfo since there's no check on the upper bound of noa_num. > Bound noa_num against P2P_MAX_NOA_NUM. > > Reported-by: Nicolas Waisman >

Re: [PATCH v2] rtlwifi: Fix potential overflow on P2P code

2019-10-20 Thread Kalle Valo
Laura Abbott writes: > On 10/19/19 6:51 AM, Kalle Valo wrote: >> Laura Abbott writes: >> >>> Nicolas Waisman noticed that even though noa_len is checked for >>> a compatible length it's still possible to overrun the buffers >>> of p2pinfo since there's no check on the upper bound of noa_num.

Re: [PATCH v2] rtlwifi: Fix potential overflow on P2P code

2019-10-19 Thread Laura Abbott
On 10/19/19 6:51 AM, Kalle Valo wrote: Laura Abbott writes: Nicolas Waisman noticed that even though noa_len is checked for a compatible length it's still possible to overrun the buffers of p2pinfo since there's no check on the upper bound of noa_num. Bound noa_num against P2P_MAX_NOA_NUM.

Re: [PATCH v2] rtlwifi: Fix potential overflow on P2P code

2019-10-19 Thread Kalle Valo
Pkshih writes: > On Fri, 2019-10-18 at 07:43 -0400, Laura Abbott wrote: >> Nicolas Waisman noticed that even though noa_len is checked for >> a compatible length it's still possible to overrun the buffers >> of p2pinfo since there's no check on the upper bound of noa_num. >> Bound noa_num

Re: [PATCH v2] rtlwifi: Fix potential overflow on P2P code

2019-10-19 Thread Kalle Valo
Laura Abbott writes: > Nicolas Waisman noticed that even though noa_len is checked for > a compatible length it's still possible to overrun the buffers > of p2pinfo since there's no check on the upper bound of noa_num. > Bound noa_num against P2P_MAX_NOA_NUM. > > Reported-by: Nicolas Waisman >

Re: [PATCH v2] rtlwifi: Fix potential overflow on P2P code

2019-10-18 Thread Pkshih
On Fri, 2019-10-18 at 07:43 -0400, Laura Abbott wrote: > Nicolas Waisman noticed that even though noa_len is checked for > a compatible length it's still possible to overrun the buffers > of p2pinfo since there's no check on the upper bound of noa_num. > Bound noa_num against P2P_MAX_NOA_NUM. > >