RE: [PATCH 1/4] ozwpan: Use proper check to prevent heap overflow

From: Jason A. Donenfeld > Sent: 13 May 2015 19:34 > Since elt->length is a u8, we can make this variable a u8. Then we can > do proper bounds checking more easily. Without this, a potentially > negative value is passed to the memcpy inside oz_hcd_get_desc_cnf, > resulting in a remotely exploitable

[PATCH 1/4] ozwpan: Use proper check to prevent heap overflow

Since elt->length is a u8, we can make this variable a u8. Then we can do proper bounds checking more easily. Without this, a potentially negative value is passed to the memcpy inside oz_hcd_get_desc_cnf, resulting in a remotely exploitable heap overflow with network supplied data. This could resu