diff options
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/cmdevt.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c index 268a795db486..6e04d7da6217 100644 --- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c +++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c @@ -1494,6 +1494,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, struct hw_spec_max_conn *max_conn; u16 resp_size, api_id; int i, left_len, parsed_len = 0; + int tlv_len; adapter->fw_cap_info = le32_to_cpu(hw_spec->fw_cap_info); @@ -1559,8 +1560,16 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, left_len = resp_size - sizeof(struct host_cmd_ds_get_hw_spec); while (left_len > sizeof(struct mwifiex_ie_types_header)) { tlv = (void *)&hw_spec->tlvs + parsed_len; + tlv_len = sizeof(*tlv) + le16_to_cpu(tlv->len); + + if (tlv_len > left_len) + break; + switch (le16_to_cpu(tlv->type)) { case TLV_TYPE_API_REV: + if (tlv_len < sizeof(struct hw_spec_api_rev)) + break; + api_rev = (struct hw_spec_api_rev *)tlv; api_id = le16_to_cpu(api_rev->api_id); switch (api_id) { @@ -1613,6 +1622,9 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, } break; case TLV_TYPE_MAX_CONN: + if (tlv_len < sizeof(struct hw_spec_max_conn)) + break; + max_conn = (struct hw_spec_max_conn *)tlv; adapter->max_p2p_conn = max_conn->max_p2p_conn; adapter->max_sta_conn = max_conn->max_sta_conn; |