refs/heads/main - platform/hardware/bsp/kernel/intel/minnowboard-v3.14

commit: f66a7ece097f8ac63659862d3e9554fd8c21882d
[log]
author: Patrick Tjin <pattjin@google.com>
Wed Dec 09 21:17:56 2015 -0800
committer: Kees Cook <keescook@google.com>
Thu Mar 10 10:36:57 2016 -0800
tree: a73f93c926908d7dc83389db16a2716c1a541af7
parent: b24ed15b1ec4331ec8f32edf1a8124a19de25a17 [diff]

net: wireless: bcmdhd: check packet length for event messages

Check the datalen field is less than the size of
packet received from the network.

Signed-off-by: Patrick Tjin <pattjin@google.com>

Bug: 27335472

[fixes CVE-2016-0802]
Signed-off-by: Kees Cook <keescook@chromium.org>
Change-Id: I4fdbbe5218c1d34f928069237382c7f9ecb3b25f

drivers/net/wireless/bcmdhd/dhd.h[diff]
drivers/net/wireless/bcmdhd/dhd_common.c[diff]
drivers/net/wireless/bcmdhd/dhd_linux.c[diff]

3 files changed

tree: a73f93c926908d7dc83389db16a2716c1a541af7