From: Qing Xu <m1s5p6688@gmail.com>
Date: Thu, 2 Jan 2020 02:39:26 +0000 (+0800)
Subject: mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;ds=sidebyside;h=91b836b01c788932d86a448d26561740d22e7c9b;hp=91b836b01c788932d86a448d26561740d22e7c9b;p=sagit-ice-cold%2Fkernel_xiaomi_msm8998.git

mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

[ Upstream commit 3a9b153c5591548612c3955c9600a98150c81875 ]

mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---