diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-15 21:57:50 +0800 |
|---|---|---|
| committer | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2026-07-15 20:51:28 +0300 |
| commit | 7410e4548a17bd868dfc60b48f2e78eacde3ad78 (patch) | |
| tree | 6873b7ac6db00589cdd723d3cea44c7f6c103e6d /tools/perf/scripts/python/net_dropmonitor.py | |
| parent | 94280e6e0c69a5327e377803732f494d8b5a74cd (diff) | |
wifi: iwlwifi: validate PNVM SKU TLV length
iwl_pnvm_parse() reads an iwl_sku_id from an
IWL_UCODE_TLV_PNVM_SKU payload after only checking that the generic TLV
payload is present.
A short type-specific payload can therefore make the three data[] reads
extend beyond the TLV. Reject SKU TLVs shorter than the structure before
accessing it.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715135916.24417-1-pengpeng@iscas.ac.cn
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Diffstat (limited to 'tools/perf/scripts/python/net_dropmonitor.py')
0 files changed, 0 insertions, 0 deletions