]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 8a22e79) | patch
radiotap: fix bitmap-end-finding buffer overrun
authorJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 11:04:36 +0000 (12:04 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 11:06:43 +0000 (12:06 +0100)
commitb0c76d650716c6493a900121bb8cf1107bd7987c
treed43aaa563d7e977e8b8122777baef54930528049tree | snapshot
parent8a22e79d15186735e293b320cd7d9cc48f86f7e0commit | diff
radiotap: fix bitmap-end-finding buffer overrun

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/radiotap.c diff | blob | history
Linux Kernel Source Tree.