Kevin Cernekee <cerne...@chromium.org> wrote: > The length of the data in the received skb is currently passed into > brcmf_fweh_process_event() as packet_len, but this value is not checked. > event_packet should be followed by DATALEN bytes of additional event > data. Ensure that the received packet actually contains at least > DATALEN bytes of additional data, to avoid copying uninitialized memory > into event->data. > > Cc: <sta...@vger.kernel.org> # v3.8 > Suggested-by: Mattias Nissler <mniss...@chromium.org> > Signed-off-by: Kevin Cernekee <cerne...@chromium.org>
Patch applied to wireless-drivers.git, thanks. dd2349121bb1 brcmfmac: Add check for short event packets -- https://patchwork.kernel.org/patch/9954607/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
