Kees Cook 12e3c0433e libertas: Avoid reading past end of buffer ... Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, redefine the stat strings to be ETH_GSTRING_LEN sizes, like other drivers. This lets us use a single memcpy that does not leak rodata contents. Additionally adjust indentation to keep checkpatch.pl happy. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay <danielmicay@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>		2017-05-24 16:43:54 +03:00
..
libertas	libertas: Avoid reading past end of buffer	2017-05-24 16:43:54 +03:00
libertas_tf	wireless: Set NL80211_EXT_FEATURE_CQM_RSSI_LIST in multiple drivers	2017-03-06 09:21:39 +01:00
mwifiex	mwifiex: add missing USB-descriptor endianness conversion	2017-05-19 09:03:04 +03:00
Kconfig
Makefile
mwl8k.c	mac80211: separate encoding/bandwidth from flags	2017-04-28 10:41:45 +02:00