usb: check RNDIS buffer offsets & length
When processing remote NDIS control message packets, the USB Net device emulator uses a fixed length(4096) data buffer. The incoming informationBufferOffset & Length combination could overflow and cross that range. Check control message buffer offsets and length to avoid it. Reported-by: NQinghao Tang <luodalongde@gmail.com> Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org> Message-id: 1455648821-17340-3-git-send-email-ppandit@redhat.com Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Showing