diff options
| author | Ingo Molnar <mingo@kernel.org> | 2014-01-05 12:34:29 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2014-01-05 12:34:29 +0100 |
| commit | ef0b8b9a521c65201bfca9747ee1bf374296133c (patch) | |
| tree | 644c3390c07d06fb7807182a4935f7c3f675b157 /net/wireless/radiotap.c | |
| parent | 5c12af0c41e3417e1939095325920463b5f8e726 (diff) | |
| parent | d6e0a2dd12f4067a5bcefb8bbd8ddbeff800afbc (diff) | |
Merge tag 'v3.13-rc7' into x86/efi-kexec to resolve conflicts
Conflicts:
arch/x86/platform/efi/efi.c
drivers/firmware/efi/Kconfig
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'net/wireless/radiotap.c')
| -rw-r--r-- | net/wireless/radiotap.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index a271c27fac7..722da616438 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init( /* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) { + if ((unsigned long)iterator->_arg - + (unsigned long)iterator->_rtheader + sizeof(uint32_t) > + (unsigned long)iterator->_max_length) + return -EINVAL; while (get_unaligned_le32(iterator->_arg) & (1 << IEEE80211_RADIOTAP_EXT)) { iterator->_arg += sizeof(uint32_t); |