)]}'
{
  "commit": "ec3bb975c6013aa2f5e8a96a0bee2c8d39618e89",
  "tree": "de7f06bddfd498f2c6eca0478ab5eb9750695482",
  "parents": [
    "d74adafded9ceb57fca7012ae1e24d512dd8dcb6"
  ],
  "author": {
    "name": "qize wang",
    "email": "wangqize888888888@gmail.com",
    "time": "Fri Nov 29 18:10:54 2019 +0800"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Sun Jan 12 12:11:50 2020 +0100"
  },
  "message": "mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()\n\n[ Upstream commit 1e58252e334dc3f3756f424a157d1b7484464c40 ]\n\nmwifiex_process_tdls_action_frame() without checking\nthe incoming tdls infomation element\u0027s vality before use it,\nthis may cause multi heap buffer overflows.\n\nFix them by putting vality check before use it.\n\nIE is TLV struct, but ht_cap and  ht_oper aren’t TLV struct.\nthe origin marvell driver code is wrong:\n\nmemcpy(\u0026sta_ptr-\u003etdls_cap.ht_oper, pos,....\nmemcpy((u8 *)\u0026sta_ptr-\u003etdls_cap.ht_capb, pos,...\n\nFix the bug by changing pos(the address of IE) to\npos+2 ( the address of IE value ).\n\nSigned-off-by: qize wang \u003cwangqize888888888@gmail.com\u003e\nSigned-off-by: Kalle Valo \u003ckvalo@codeaurora.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e76af2866a19350ff1326a3fe966b1c9737d8beb",
      "old_mode": 33188,
      "old_path": "drivers/net/wireless/marvell/mwifiex/tdls.c",
      "new_id": "b5340af9fa5ecfd0a2719c0a7b14de9f7ff68f84",
      "new_mode": 33188,
      "new_path": "drivers/net/wireless/marvell/mwifiex/tdls.c"
    }
  ]
}