projects / platform / kernel / linux-3.10.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 4e7255f) | patch
radiotap: fix bitmap-end-finding buffer overrun
authorJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 11:04:36 +0000 (12:04 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Jan 2014 20:24:23 +0000 (12:24 -0800)
commit6646ce885ff19da84a20193b1b36629f7953305a
tree209af9d4c83ba64c7c3301c7dd4b0dc15dd2d485tree | snapshot
parent4e7255f33a03b219d76b32b7e7e1cb395004668acommit | diff
radiotap: fix bitmap-end-finding buffer overrun

commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/radiotap.c diff | blob | history
Domain: System / Kernel;