diff options
| author | Amitkumar Karwar <[email protected]> | 2013-10-22 15:24:44 -0700 |
|---|---|---|
| committer | John W. Linville <[email protected]> | 2013-11-11 14:38:56 -0500 |
| commit | fe1c9a443e0d1e0af790883f091fb1c4f418bc8f (patch) | |
| tree | 5bb5700952ca24730ebd1f253353290d38a29b0e /net/lapb/lapb_timer.c | |
| parent | 930fd35c8de88cc1ce934aa655181c4879422a37 (diff) | |
mwifiex: fix invalid memory access in mwifiex_get_power_level()
With "while (length)" check we may end up in accessing invalid
memory in last iteration.
This patch makes sure that tlv length is not less than the length
of structure mwifiex_power_group when min/max power is calculated.
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Amitkumar Karwar <[email protected]>
Signed-off-by: Bing Zhao <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions