| commit | a42d665a3c05e23df0f2700abdc801e7b136a67a | [log] [tgz] |
|---|---|---|
| author | Patrick Tjin <pattjin@google.com> | Wed Dec 09 21:17:56 2015 -0800 |
| committer | Kees Cook <keescook@chromium.org> | Thu Mar 10 13:13:39 2016 -0800 |
| tree | 95f9531542c48e407ce6ea2f2560ec3a93f9d192 | |
| parent | 9f6c596b5e4402a8d74606f18138bf8b9aae0cea [diff] |
net: wireless: bcmdhd: check packet length for event messages Check the datalen field is less than the size of packet received from the network. Signed-off-by: Patrick Tjin <pattjin@google.com> Bug: 27335472 [fixes CVE-2016-0802] Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I92b394e85cfc61a0e08fb5bc573a4c000e027fad