tag 350f3b9bbc438754638c2dab34fdc254b95cc4e9
tagger The Android Open Source Project <initial-contribution@android.com> Tue Jan 03 16:49:01 2017 -0800
object cbf66a616bb08cc6c932e4122f3271df83e253bb

Android 7.1.1 Release 0.18

commit cbf66a616bb08cc6c932e4122f3271df83e253bb
author Insun Song <insun.song@broadcom.com> Tue Oct 25 13:33:18 2016 -0700
committer Patrick Tjin <pattjin@google.com> Thu Nov 17 09:50:41 2016 -0800
tree b55309821e3184c459d694e67335c898843d74fa
parent 9db2853dd4db722666758625dc9e65888ba597cf

net: wireless: bcmdhd: fix buffer overrun in private command path

buffer overrun case found when length parameter manipulated.

1. if input parameter buffer length is less than 4k,
then allocate 4k by default. It help to get enough margin
for output string overwritten.

2. added additional length check not to override user space
allocated buffer size.

bug=29000183
Change-Id: I0c15d764c1648920f0214ec47ada689ca44ebfba
Signed-off-by: Insun Song <insun.song@broadcom.com>