| commit | 8c2e01fe0733843f2aa07a48db25ea608ab305bf | [log] [tgz] |
|---|---|---|
| author | Insun Song <insun.song@broadcom.com> | Mon Jun 05 09:42:44 2017 -0700 |
| committer | android-build-team Robot <android-build-team-robot@google.com> | Tue Jun 13 18:08:54 2017 +0000 |
| tree | 6ea1fa6a0a33091d2056c90a02b128a3a0a2fae6 | |
| parent | 48bfa583a4fae0ba062138b455ebdb8887c22f29 [diff] |
net: wireless: bcmdhd: update bcm4354/56 FW (7.35.101.6) adding validation for WME IE length in assoc request/response/beacon frame. This help to prevent buffer overrun especially when malformed WME/WME_PARAMETER IE injected by driveby attck. Signed-off-by: Insun Song <insun.song@broadcom.com> Bug: 38041027 Change-Id: Id3bcc264801582b1e283f3b3f7d9053681e3ce8e (cherry picked from commit c59d2fbfe0ca8cc2a7419a860bfd5f48c7b66066)
diff --git a/bcmdhd/firmware/bcm4354/fw_bcm4354.bin b/bcmdhd/firmware/bcm4354/fw_bcm4354.bin index 724b1fa..c17696d 100644 --- a/bcmdhd/firmware/bcm4354/fw_bcm4354.bin +++ b/bcmdhd/firmware/bcm4354/fw_bcm4354.bin Binary files differ
diff --git a/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin b/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin index 9c95b5c..927c148 100644 --- a/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin +++ b/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin Binary files differ
diff --git a/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin b/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin old mode 100755 new mode 100644 index f25ff54..891f9cf --- a/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin +++ b/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin Binary files differ
diff --git a/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin b/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin old mode 100755 new mode 100644 index 2544f66..4224238 --- a/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin +++ b/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin Binary files differ