diff options
Diffstat (limited to 'net/wireless/radiotap.c')
| -rw-r--r-- | net/wireless/radiotap.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index 617a310025b1..60549a4a2f98 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -122,6 +122,10 @@ int ieee80211_radiotap_iterator_init( /* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) { + if ((unsigned long)iterator->_arg - + (unsigned long)iterator->_rtheader + sizeof(uint32_t) > + (unsigned long)iterator->_max_length) + return -EINVAL; while (get_unaligned_le32(iterator->_arg) & (1 << IEEE80211_RADIOTAP_EXT)) { iterator->_arg += sizeof(uint32_t); |