brcmfmac: Add check for short event packets
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:24 +0000 (21:08 -0700)
committerRaspbian kernel package updater <root@raspbian.org>
Sun, 8 Oct 2017 01:09:29 +0000 (01:09 +0000)
commit172ceca9e227c92efffebf9e96c216b8ae24df50
tree2463ddd4d27aaabfe1d790c3bc86af62a1dd208d
parent1f75cfbaf31ecd46f5dcf226911c235ed07e895e
brcmfmac: Add check for short event packets

The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c