[RAMEN9610-21029]rtlwifi: Fix potential overflow on P2P code
authorLaura Abbott <labbott@redhat.com>
Fri, 18 Oct 2019 11:43:21 +0000 (07:43 -0400)
committerchenyt9 <chenyt9@lenovo.com>
Wed, 1 Apr 2020 09:32:33 +0000 (17:32 +0800)
commit96b8f58241830d2cf3ca7a31444c83caa5af3dd7
treec726cccfb25438a5c88a6e4a2291a445d5e9539c
parente4323223f5a2fab9f368eba11fbd14b6a5e16028
[RAMEN9610-21029]rtlwifi: Fix potential overflow on P2P code

commit 8c55dedb795be8ec0cf488f98c03a1c2176f7fb1 upstream.

Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bound noa_num against P2P_MAX_NOA_NUM.

Change-Id: I2c8d9c778e901815603f53628e0166106b36c640
Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/realtek/rtlwifi/ps.c