From 48bfa583a4fae0ba062138b455ebdb8887c22f29 Mon Sep 17 00:00:00 2001 From: Insun Song Date: Fri, 2 Jun 2017 18:15:08 -0700 Subject: net: wireless: bcmdhd: update bcm4358 FW (7.112.201.4) [DO NOT MERGE] adding validation for WME IE length in assoc request/response/beacon frame. This help to prevent buffer overrun especially when malformed WME/WME_PARAMETER IE injected by driveby attck. Change-Id: I6dbe2b534d8d5aedac0bdfa8e5459d7d9a3ba4dd Signed-off-by: Insun Song Bug: 38041027 (cherry picked from commit d09c96966de0c41bfa4efe372e3f21affbae7082) --- bcmdhd/firmware/bcm4358/fw_bcm4358.bin | Bin 629248 -> 629264 bytes bcmdhd/firmware/bcm4358/fw_bcm4358_ap.bin | Bin 560830 -> 560846 bytes 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 bcmdhd/firmware/bcm4358/fw_bcm4358.bin mode change 100755 => 100644 bcmdhd/firmware/bcm4358/fw_bcm4358_ap.bin diff --git a/bcmdhd/firmware/bcm4358/fw_bcm4358.bin b/bcmdhd/firmware/bcm4358/fw_bcm4358.bin old mode 100755 new mode 100644 index 2ae8dab..fd4c428 Binary files a/bcmdhd/firmware/bcm4358/fw_bcm4358.bin and b/bcmdhd/firmware/bcm4358/fw_bcm4358.bin differ diff --git a/bcmdhd/firmware/bcm4358/fw_bcm4358_ap.bin b/bcmdhd/firmware/bcm4358/fw_bcm4358_ap.bin old mode 100755 new mode 100644 index 19c26a8..20a0bcc Binary files a/bcmdhd/firmware/bcm4358/fw_bcm4358_ap.bin and b/bcmdhd/firmware/bcm4358/fw_bcm4358_ap.bin differ -- cgit v1.2.3 From 8c2e01fe0733843f2aa07a48db25ea608ab305bf Mon Sep 17 00:00:00 2001 From: Insun Song Date: Mon, 5 Jun 2017 09:42:44 -0700 Subject: net: wireless: bcmdhd: update bcm4354/56 FW (7.35.101.6) adding validation for WME IE length in assoc request/response/beacon frame. This help to prevent buffer overrun especially when malformed WME/WME_PARAMETER IE injected by driveby attck. Signed-off-by: Insun Song Bug: 38041027 Change-Id: Id3bcc264801582b1e283f3b3f7d9053681e3ce8e (cherry picked from commit c59d2fbfe0ca8cc2a7419a860bfd5f48c7b66066) --- bcmdhd/firmware/bcm4354/fw_bcm4354.bin | Bin 626573 -> 626589 bytes bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin | Bin 548604 -> 548620 bytes bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin | Bin 588621 -> 588638 bytes bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin | Bin 661983 -> 661999 bytes 4 files changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin mode change 100755 => 100644 bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin diff --git a/bcmdhd/firmware/bcm4354/fw_bcm4354.bin b/bcmdhd/firmware/bcm4354/fw_bcm4354.bin index 724b1fa..c17696d 100644 Binary files a/bcmdhd/firmware/bcm4354/fw_bcm4354.bin and b/bcmdhd/firmware/bcm4354/fw_bcm4354.bin differ diff --git a/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin b/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin index 9c95b5c..927c148 100644 Binary files a/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin and b/bcmdhd/firmware/bcm4354/fw_bcm4354_ap.bin differ diff --git a/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin b/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin old mode 100755 new mode 100644 index f25ff54..891f9cf Binary files a/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin and b/bcmdhd/firmware/bcm4356/fw_bcm4356_ap_pcie.bin differ diff --git a/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin b/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin old mode 100755 new mode 100644 index 2544f66..4224238 Binary files a/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin and b/bcmdhd/firmware/bcm4356/fw_bcm4356_pcie.bin differ -- cgit v1.2.3