Skip to content
Snippets Groups Projects
Commit 0e973fee authored by Zhao Xuewen's avatar Zhao Xuewen
Browse files

net: wireless: bcmdhd: validate remaining space in WPS IE


Validate the amount of remaining space in the WPS IE
to prevent reading past the end of the buffer.

Change-Id: I897ef4c54b6830f1f24bb958965bdf6c3b83758a
Signed-off-by: default avatarPatrick Tjin <pattjin@google.com>
parent f7d474ad
Branches
Tags
No related merge requests found
......@@ -1138,7 +1138,14 @@ wl_validate_wps_ie(char *wps_ie, s32 wps_ie_len, bool *pbc)
subelt_len = HTON16(val);
len -= 4; /* for the attr id, attr len fields */
if (len < subelt_len) {
WL_ERR(("not enough data, len %d, subelt_len %d\n", len,
subelt_len));
break;
}
len -= subelt_len; /* for the remaining fields in this attribute */
WL_DBG((" subel=%p, subelt_id=0x%x subelt_len=%u\n",
subel, subelt_id, subelt_len));
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment