tree 071bfc93e3c1d47fd0d2e0ad284fd6df770a4f9e
parent 2200e9453bf778d8a22098ae1383444ba7c63cf1
author Patrick Tjin <pattjin@google.com> 1449724676 -0800
committer Kees Cook <keescook@google.com> 1457736139 +0000

net: wireless: bcmdhd: check packet length for event messages

Check the datalen field is less than the size of
packet received from the network.

Signed-off-by: Patrick Tjin <pattjin@google.com>

Bug: 27335472

[fixes CVE-2016-0802]
Signed-off-by: Kees Cook <keescook@chromium.org>
Change-Id: I87171cf09bb8dc55da21c4d8ee3101f0ed0a9a70