projects / wrapfs-5.3.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 50226b9) | patch
radiotap: fix bitmap-end-finding buffer overrun
authorJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 11:04:36 +0000 (12:04 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 15 Feb 2014 19:20:13 +0000 (19:20 +0000)
commit39e87a9623c8b1fe690dccc18b885b56a2891aca
tree1df97d749e5861e51c17584555aa28be052b216etree | snapshot
parent50226b9992e79d43579b92650ecbfdbc1479980ccommit | diff
radiotap: fix bitmap-end-finding buffer overrun

commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/wireless/radiotap.c diff | blob | history
wrapfs-5.3.y