From d8bfab393ad856c9f43c3293676763ef1ecb5b68 Mon Sep 17 00:00:00 2001 From: Sarada Prasanna Garnayak Date: Tue, 11 Jul 2017 13:01:19 +0530 Subject: [PATCH] wcnss: fix the potential buffer flow issue in firmware setup Add the check against negative or invalid firmware size passed by the userspace thread in firmware setup sysfs write operation. Update the datatype of the variable which holds the firmware size passed by userspace thread during firmware setup and WLAN calibration data update process. CRs-Fixed: 2072966 Change-Id: I8c84ad0d1b0a5f44a39c9c5b228734b0f693e8dd Signed-off-by: Sarada Prasanna Garnayak --- drivers/net/wireless/wcnss/wcnss_wlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/wcnss/wcnss_wlan.c b/drivers/net/wireless/wcnss/wcnss_wlan.c index 505a9e016777..9347882fba92 100644 --- a/drivers/net/wireless/wcnss/wcnss_wlan.c +++ b/drivers/net/wireless/wcnss/wcnss_wlan.c @@ -397,7 +397,7 @@ static struct { int user_cal_read; int user_cal_available; u32 user_cal_rcvd; - int user_cal_exp_size; + u32 user_cal_exp_size; int iris_xo_mode_set; int fw_vbatt_state; char wlan_nv_macAddr[WLAN_MAC_ADDR_SIZE];