| commit | f66a7ece097f8ac63659862d3e9554fd8c21882d | [log] [tgz] |
|---|---|---|
| author | Patrick Tjin <pattjin@google.com> | Wed Dec 09 21:17:56 2015 -0800 |
| committer | Kees Cook <keescook@google.com> | Thu Mar 10 10:36:57 2016 -0800 |
| tree | a73f93c926908d7dc83389db16a2716c1a541af7 | |
| parent | b24ed15b1ec4331ec8f32edf1a8124a19de25a17 [diff] |
net: wireless: bcmdhd: check packet length for event messages Check the datalen field is less than the size of packet received from the network. Signed-off-by: Patrick Tjin <pattjin@google.com> Bug: 27335472 [fixes CVE-2016-0802] Signed-off-by: Kees Cook <keescook@chromium.org> Change-Id: I4fdbbe5218c1d34f928069237382c7f9ecb3b25f