aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2013-12-16 12:04:36 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-01-08 09:42:12 -0800
commita86f1d64f44d5e443eb0f5eb9498583f364e9f33 (patch)
tree9ec147d60b5f856dee6f67501f17a5ff18947f23
parentc89c4dc7c370102ed0b5c0d90d892364d4980e37 (diff)
downloadlinux-linaro-stable-a86f1d64f44d5e443eb0f5eb9498583f364e9f33.tar.gz
radiotap: fix bitmap-end-finding buffer overrun
commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream. Evan Huus found (by fuzzing in wireshark) that the radiotap iterator code can access beyond the length of the buffer if the first bitmap claims an extension but then there's no data at all. Fix this. Reported-by: Evan Huus <eapache@gmail.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/wireless/radiotap.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 617a310025b1..60549a4a2f98 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -122,6 +122,10 @@ int ieee80211_radiotap_iterator_init(
/* find payload start allowing for extended bitmap(s) */
if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
+ if ((unsigned long)iterator->_arg -
+ (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
+ (unsigned long)iterator->_max_length)
+ return -EINVAL;
while (get_unaligned_le32(iterator->_arg) &
(1 << IEEE80211_RADIOTAP_EXT)) {
iterator->_arg += sizeof(uint32_t);