From: Johannes Berg Date: Mon, 16 Dec 2013 11:04:36 +0000 (+0100) Subject: radiotap: fix bitmap-end-finding buffer overrun X-Git-Tag: upstream/snapshot3+hdmi~3687^2~4^2^2~2^2~2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git radiotap: fix bitmap-end-finding buffer overrun Evan Huus found (by fuzzing in wireshark) that the radiotap iterator code can access beyond the length of the buffer if the first bitmap claims an extension but then there's no data at all. Fix this. Cc: stable@vger.kernel.org Reported-by: Evan Huus Signed-off-by: Johannes Berg --- diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index a271c27..722da61 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init( /* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1<_arg - + (unsigned long)iterator->_rtheader + sizeof(uint32_t) > + (unsigned long)iterator->_max_length) + return -EINVAL; while (get_unaligned_le32(iterator->_arg) & (1 << IEEE80211_RADIOTAP_EXT)) { iterator->_arg += sizeof(uint32_t);