mirror of https://github.com/torvalds/linux.git
0cdfa9e6f0
There is no validation of 'e->no_of_channels' which can trigger an out-of-bounds write in the following 'memset' call. Validate that the number of channels does not extends beyond the size of the channel list element. Signed-off-by: Phil Turnbull <philipturnbull@github.com> Tested-by: Ajay Kathat <ajay.kathat@microchip.com> Acked-by: Ajay Kathat <ajay.kathat@microchip.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull@github.com |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| cfg80211.c | ||
| cfg80211.h | ||
| fw.h | ||
| hif.c | ||
| hif.h | ||
| mon.c | ||
| netdev.c | ||
| netdev.h | ||
| sdio.c | ||
| spi.c | ||
| wlan.c | ||
| wlan.h | ||
| wlan_cfg.c | ||
| wlan_cfg.h | ||
| wlan_if.h | ||