net: wireless: bcmdhd: fix buffer overrun in wlfc reordering
Insun Song [Wed, 25 Jan 2017 19:41:49 +0000 (11:41 -0800)]
added boundary check not to override allocated buffer

Bug 1887273
Bug 200288656

Signed-off-by: Insun Song <insun.song@broadcom.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Change-Id: Iad44141ba4e4cd224eda292c05ffe525bf74227d
Bug: 34203305
Reviewed-on: http://git-master/r/1459054
(cherry picked from commit b88e3d0b355ce821c92760bf41d04a917dab092d)
Reviewed-on: http://git-master/r/1463482
GVS: Gerrit_Virtual_Submit
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>

drivers/net/wireless/bcmdhd/dhd_wlfc.c

index e6355ae..2cb55c7 100644 (file)
@@ -2549,7 +2549,7 @@ static void
 _dhd_wlfc_reorderinfo_indicate(uint8 *val, uint8 len, uchar *info_buf, uint *info_len)
 {
        if (info_len) {
-               if (info_buf) {
+               if (info_buf && (len <= WLHOST_REORDERDATA_TOTLEN)) {
                        bcopy(val, info_buf, len);
                        *info_len = len;
                }