Insun Song 987945cbcb net: wireless: bcmdhd: fix integer overflow in wl_get_assoc_ies ...

integer overflow case found where signed integer variable converted to
unsigned one without proper bounds checking.
Then this would result in kernel memory corruption by OOB write.

Signed-off-by: Insun Song <insun.song@broadcom.com>
Bug: 70722061
Change-Id: Idb1aa16ae1bae9c3f601e6688cd263fa95a93bdf
CVE-2017-13292
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-08 16:35:11 +02:00

..

appletalk

…

arcnet

…

bonding

…

caif

…

can

…

cris

…

dsa

…

ethernet

…

fddi

…

hamradio

…

hippi

…

hyperv

…

irda

…

phy

…

plip

…

ppp

Merge remote-tracking branch 'google-common/deprecated/android-3.4' into lineage-16.0

2019-08-06 11:41:21 +02:00

slip

…

team

…

tokenring

…

usb

BACKPORT: USB: core: harden cdc_parse_cdc_header

2019-08-08 16:34:18 +02:00

vmxnet3

…

wan

…

wimax

…

wireless

net: wireless: bcmdhd: fix integer overflow in wl_get_assoc_ies

2019-08-08 16:35:11 +02:00

xen-netback

…

dummy.c

…

eql.c

…

ifb.c

…

Kconfig

…

LICENSE.SRC

…

loopback.c

…

macvlan.c

…

macvtap.c

…

Makefile

…

mdio.c

…

mii.c

…

netconsole.c

…

rionet.c

…

sb1000.c

…

Space.c

…

sungem_phy.c

…

tun.c

…

veth.c

…

virtio_net.c

…

xen-netfront.c

…