Skip to content

Commit d4e3521

Browse files
committed
wifi: iwlwifi: limit printed string from FW file
jira LE-3666 cve CVE-2025-21905 Rebuild_History Non-Buildable kernel-5.14.0-570.30.1.el9_6 commit-author Johannes Berg <johannes.berg@intel.com> commit e0dc2c1 There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's the last TLV in the file, it can perhaps even read beyond the end of the file buffer. Fix that by limiting the print format to the size of the buffer we have. Fixes: aee1b63 ("iwlwifi: support fseq tlv and print fseq version") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20250209143303.cb5f9d0c2f5d.Idec695d53c6c2234aade306f7647b576c7e3d928@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> (cherry picked from commit e0dc2c1) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
1 parent 6d7c2e0 commit d4e3521

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/net/wireless/intel/iwlwifi/iwl-drv.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1197,7 +1197,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
11971197

11981198
if (tlv_len != sizeof(*fseq_ver))
11991199
goto invalid_tlv_len;
1200-
IWL_INFO(drv, "TLV_FW_FSEQ_VERSION: %s\n",
1200+
IWL_INFO(drv, "TLV_FW_FSEQ_VERSION: %.32s\n",
12011201
fseq_ver->version);
12021202
}
12031203
break;

0 commit comments

Comments
 (0)