diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2016-02-17 00:23:41 +0530 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2016-02-23 10:38:01 +0100 |
| commit | fe3c546c5ff2a6210f9a4d8561cc64051ca8603e (patch) | |
| tree | a03737fc0dd0904f6b6afc0b7c07c87064450ca5 /target-alpha | |
| parent | 64c9bc181fc78275596649f591302d72df2d3071 (diff) | |
usb: check RNDIS buffer offsets & length
When processing remote NDIS control message packets,
the USB Net device emulator uses a fixed length(4096) data buffer.
The incoming informationBufferOffset & Length combination could
overflow and cross that range. Check control message buffer
offsets and length to avoid it.
Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 1455648821-17340-3-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'target-alpha')
0 files changed, 0 insertions, 0 deletions