Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
mwifiex_ret_wmm_get_status() calls memcpy() without checking the destination size.Since the source is given from remote AP which contains illegal wmm elements , this may trigger a heap buffer overflow. Fix it by putting the length check before calling memcpy(). Signed-off-by: Qing Xu <m1s5p6688@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
- Loading branch information