projects / unionfs-2.6.39.y.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 52b5acd) | patch
libertas: fix buffer overrun
authorJohannes Berg <johannes@sipsolutions.net>
Sun, 2 Nov 2008 19:30:21 +0000 (19:30 +0000)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 10 Nov 2008 18:50:05 +0000 (10:50 -0800)
commitaafa27b18c721966bb4320d81781b56176c94cd7
treed41040cdd12e838f07a808bc570e94bc0b51f127tree | snapshot
parent52b5acdd4f41f95472437cdc8886eb195a9e433acommit | diff
libertas: fix buffer overrun

commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream

If somebody sends an invalid beacon/probe response, that can trash the
whole BSS descriptor. The descriptor is, luckily, large enough so that
it cannot scribble past the end of it; it's well above 400 bytes long.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/net/wireless/libertas/scan.c diff | blob | history
unionfs2-2.6.39.y