diff options
| author | Jeff Chen <jeff.chen_1@nxp.com> | 2026-10-12 20:36:24 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-10-13 14:01:12 +0200 |
| commit | fbcdcc450c47b2dbc0e3c790a40071e7485bb68c (patch) | |
| tree | 801287cbc4184f875097ca7fc63b769e288a235c | |
| parent | 958f20d5aa0aa645068454fdb62ebc625ac9a115 (diff) | |
wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing
Validate TLV lengths before accessing TLV payloads in
mwifiex_ret_get_hw_spec().
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/20261012123624.3147417-3-jeff.chen_1@oss.nxp.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/cmdevt.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c index 268a795db486..6e04d7da6217 100644 --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c @@ -1494,6 +1494,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, struct hw_spec_max_conn *max_conn; u16 resp_size, api_id; int i, left_len, parsed_len = 0; + int tlv_len; adapter->fw_cap_info = le32_to_cpu(hw_spec->fw_cap_info); @@ -1559,8 +1560,16 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, left_len = resp_size - sizeof(struct host_cmd_ds_get_hw_spec); while (left_len > sizeof(struct mwifiex_ie_types_header)) { tlv = (void *)&hw_spec->tlvs + parsed_len; + tlv_len = sizeof(*tlv) + le16_to_cpu(tlv->len); + + if (tlv_len > left_len) + break; + switch (le16_to_cpu(tlv->type)) { case TLV_TYPE_API_REV: + if (tlv_len < sizeof(struct hw_spec_api_rev)) + break; + api_rev = (struct hw_spec_api_rev *)tlv; api_id = le16_to_cpu(api_rev->api_id); switch (api_id) { @@ -1613,6 +1622,9 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, } break; case TLV_TYPE_MAX_CONN: + if (tlv_len < sizeof(struct hw_spec_max_conn)) + break; + max_conn = (struct hw_spec_max_conn *)tlv; adapter->max_p2p_conn = max_conn->max_p2p_conn; adapter->max_sta_conn = max_conn->max_sta_conn; |