projects / kernel / kernel-generic.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 529cfe7) | patch
radiotap: fix bitmap-end-finding buffer overrun
authorJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 11:04:36 +0000 (12:04 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Jan 2014 20:25:13 +0000 (12:25 -0800)
commit3b3299df71d35c2a9bae5d67164d1107969a5fee
tree412bd0d933e39dc8dde366e62e404410c0947e46tree | snapshot
parent529cfe789ed45a69bf6447e4d340329fd71d8dfdcommit | diff
radiotap: fix bitmap-end-finding buffer overrun

commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/radiotap.c diff | blob | history
Domain: System / Uncategorized;