Function qtnf_event_handle_external_auth calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size. Signed-off-by: Lee Gibson <leegib@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20210419145842.345787-1-leegib@gmail.com |
||
|---|---|---|
| .. | ||
| pcie | ||
| Kconfig | ||
| Makefile | ||
| bus.h | ||
| cfg80211.c | ||
| cfg80211.h | ||
| commands.c | ||
| commands.h | ||
| core.c | ||
| core.h | ||
| debug.c | ||
| debug.h | ||
| event.c | ||
| event.h | ||
| qlink.h | ||
| qlink_util.c | ||
| qlink_util.h | ||
| qtn_hw_ids.h | ||
| shm_ipc.c | ||
| shm_ipc.h | ||
| shm_ipc_defs.h | ||
| switchdev.h | ||
| trans.c | ||
| trans.h | ||
| util.c | ||
| util.h | ||