projects / platform / kernel / linux-stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c89c4dc) | patch
radiotap: fix bitmap-end-finding buffer overrun
authorJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 11:04:36 +0000 (12:04 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Jan 2014 17:42:12 +0000 (09:42 -0800)
commita86f1d64f44d5e443eb0f5eb9498583f364e9f33
tree9ec147d60b5f856dee6f67501f17a5ff18947f23tree | snapshot
parentc89c4dc7c370102ed0b5c0d90d892364d4980e37commit | diff
radiotap: fix bitmap-end-finding buffer overrun

commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/wireless/radiotap.c diff | blob | history
Domain: System / Kernel;