diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2013-12-16 12:04:36 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-12-16 12:06:43 +0100 |
| commit | bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 (patch) | |
| tree | d43aaa563d7e977e8b8122777baef54930528049 | |
| parent | 4c4d684a55fc01dac6bee696efc56b96d0e6c03a (diff) | |
radiotap: fix bitmap-end-finding buffer overrun
Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.
Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/wireless/radiotap.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index a271c27fac7..722da616438 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init( /* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) { + if ((unsigned long)iterator->_arg - + (unsigned long)iterator->_rtheader + sizeof(uint32_t) > + (unsigned long)iterator->_max_length) + return -EINVAL; while (get_unaligned_le32(iterator->_arg) & (1 << IEEE80211_RADIOTAP_EXT)) { iterator->_arg += sizeof(uint32_t); |