744fabc338
The memcpy function assumes the dynamic array notif->matches is at least
as large as the number of bytes to copy. Otherwise, results->matches may
contain unwanted data. To guarantee safety, extend the validation in one
of the checks to ensure sufficient packet length.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| ipw2x00 | ||
| iwlegacy | ||
| iwlwifi | ||
| Kconfig | ||
| Makefile | ||