| commit | 3c99832d74777c9ec5545a92450fac5d37b0d0e1 | [log] [tgz] |
|---|---|---|
| author | Avinash Patil <patila@marvell.com> | Fri Sep 12 20:08:46 2014 +0530 |
| committer | John W. Linville <linville@tuxdriver.com> | Mon Sep 15 15:00:50 2014 -0400 |
| tree | 2df41a172c90417e2175dcc424f94d3f86a7df37 | |
| parent | 4721c63b929b13bce6860dc8ec068f86efcab2ea [diff] |
mwifiex: fix probable memory corruption while processing TDLS frame Size of RSN IE buffer in driver is 254 while maximum size of received buffer to be copied to RSN IE buffer can be 255. Add boundary check to copy maximum of 254 bytes into RSN IE buffer. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Avinash Patil <patila@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>