diff options
| author |   Alexey Kodanev <aleksei.kodanev@bell-sw.com> | 2025-05-13 12:13:04 +0000 |
|---|---|---|
| committer |   Ping-Ke Shih <pkshih@realtek.com> | 2025-05-16 09:00:52 +0800 |
| commit | 4c2c372de2e108319236203cce6de44d70ae15cd (patch) | |
| tree | b227a585efa53049347e916d2190ec82b3f5cf87 /scripts/gdb/linux/utils.py | |
| parent | wifi: rtw89: mcc: avoid redundant recalculations if no chance to improve (diff) | |
| download | wireguard-linux-4c2c372de2e108319236203cce6de44d70ae15cd.tar.xz wireguard-linux-4c2c372de2e108319236203cce6de44d70ae15cd.zip | |
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
Set the size to 6 instead of 2, since 'para' array is passed to
'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads
5 bytes:
void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)
{
...
SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);
SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));
...
SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));
Detected using the static analysis tool - Svace.
Fixes: 4136214f7c46 ("rtw88: add BT co-existence support")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250513121304.124141-1-aleksei.kodanev@bell-sw.com
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions