diff options
| author |  David S. Miller <davem@davemloft.net>
| 2019-09-15 14:17:27 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net>
| 2019-09-15 14:17:27 +0200 |
| commit | aa2eaa8c272a3211dec07ce9c6c863a7e355c10e (patch) | |
| tree | 8454a23d36b2ff36133c276ee0ba80eabc00850e /drivers/net/wireless/marvell/mwifiex/ie.c | |
| parent | Merge tag 'wireless-drivers-next-for-davem-2019-09-14' of git://git.kernel.or... (diff) | |
| parent | Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm (diff) | |
| download | linux-aa2eaa8c272a3211dec07ce9c6c863a7e355c10e.tar.gz linux-aa2eaa8c272a3211dec07ce9c6c863a7e355c10e.tar.bz2 linux-aa2eaa8c272a3211dec07ce9c6c863a7e355c10e.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Minor overlapping changes in the btusb and ixgbe drivers.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/ie.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/ie.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c index 653d347a9a19..580387f9f12a 100644 --- a/drivers/net/wireless/marvell/mwifiex/ie.c +++ b/drivers/net/wireless/marvell/mwifiex/ie.c @@ -241,6 +241,9 @@ static int mwifiex_update_vs_ie(const u8 *ies, int ies_len, } vs_ie = (struct ieee_types_header *)vendor_ie; + if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 > + IEEE_MAX_IE_SIZE) + return -EINVAL; memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length), vs_ie, vs_ie->len + 2); le16_unaligned_add_cpu(&ie->ie_length, vs_ie->len + 2); |