diff options
| author | Tristan Madani <tristan@talencesecurity.com> | 2026-04-21 16:50:17 +0300 |
|---|---|---|
| committer | Jeff Johnson <jeff.johnson@oss.qualcomm.com> | 2026-06-06 18:46:28 +0300 |
| commit | df2187acfca6c6cca372c5d35f42394d9c270b09 (patch) | |
| tree | 9f6ae33f92a977ac8ee8428b77cd0e12d77c89df /tools/lib/python | |
| parent | 88a240d86d3d64521f9194abe185ac71cc74d0bd (diff) | |
| download | linux-df2187acfca6c6cca372c5d35f42394d9c270b09.tar.xz | |
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
The firmware-controlled rsp->count field is used as the loop bound for
indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of-
bounds reads from the heap-allocated message buffer.
Add a check that count fits within the received message.
Fixes: 43efa3c0f241 ("wcn36xx: Implement print_reg indication")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-3-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions