mwifiex: Prevent memory corruption handling keys
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 8 Jul 2020 11:58:57 +0000 (14:58 +0300)
committerKalle Valo <kvalo@codeaurora.org>
Wed, 15 Jul 2020 09:13:30 +0000 (12:13 +0300)
commite18696786548244914f36ec3c46ac99c53df99c3
tree1f9afd91f9b29e93fa096b7eca5ba104f7a4fa8b
parent9187f4e840929161be957fc0be28c51e964f9824
mwifiex: Prevent memory corruption handling keys

The length of the key comes from the network and it's a 16 bit number.  It
needs to be capped to prevent a buffer overflow.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200708115857.GA13729@mwanda
drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c