| commit | 98ba63a359c8d5c1cd7cda5b99e7f7ccfc4b3e65 | [log] [tgz] |
|---|---|---|
| author | Insun Song <insun.song@broadcom.com> | Mon Jun 05 09:42:44 2017 -0700 |
| committer | android-build-team Robot <android-build-team-robot@google.com> | Tue Jun 06 20:29:32 2017 +0000 |
| tree | 654584b24770199fbb03af9e1d2ec1c8aa9e76d4 | |
| parent | 67fd6b4a55dd1b25bf611598843503c2df2e3c46 [diff] |
net: wireless: bcmdhd: update bcm4354/56 FW (7.35.101.6) adding validation for WME IE length in assoc request/response/beacon frame. This help to prevent buffer overrun especially when malformed WME/WME_PARAMETER IE injected by driveby attck. Signed-off-by: Insun Song <insun.song@broadcom.com> Bug: 38041027 Change-Id: Id3bcc264801582b1e283f3b3f7d9053681e3ce8e (cherry picked from commit c59d2fbfe0ca8cc2a7419a860bfd5f48c7b66066)