diff options
| author | Ingo Molnar <mingo@kernel.org> | 2013-11-06 06:39:45 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2013-11-06 06:39:45 +0100 |
| commit | 97c53b402fcadb50201c23914f614bf8430d9c20 (patch) | |
| tree | 3c9b94e866d150c3a2d8ac853e388c38fade8b45 /net/wireless/radiotap.c | |
| parent | 6a716c90a51338009c3bc1f460829afaed8f922d (diff) | |
| parent | 5e01dc7b26d9f24f39abace5da98ccbd6a5ceb52 (diff) | |
Merge tag 'v3.12' into core/locking to pick up mutex upates
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'net/wireless/radiotap.c')
| -rw-r--r-- | net/wireless/radiotap.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index 7d604c06c3d..a271c27fac7 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init( struct ieee80211_radiotap_header *radiotap_header, int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns) { + /* check the radiotap header can actually be present */ + if (max_length < sizeof(struct ieee80211_radiotap_header)) + return -EINVAL; + /* Linux only supports version 0 radiotap format */ if (radiotap_header->it_version) return -EINVAL; @@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init( */ if ((unsigned long)iterator->_arg - - (unsigned long)iterator->_rtheader > + (unsigned long)iterator->_rtheader + + sizeof(uint32_t) > (unsigned long)iterator->_max_length) return -EINVAL; } |