diff options
| author | Bob Copeland <me@bobcopeland.com> | 2015-07-14 08:31:56 -0400 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2015-07-17 14:39:42 +0200 |
| commit | b3e7de873df77c1fa0bc2cfaf3eaff757b80e773 (patch) | |
| tree | 046c8fc8415179b2cf90c600176790dd385e75d8 /net/mac80211 | |
| parent | 2ea752cd2ce066c5d8c1807b5310ef329885cecb (diff) | |
| download | linux-0-day-b3e7de873df77c1fa0bc2cfaf3eaff757b80e773.tar.gz linux-0-day-b3e7de873df77c1fa0bc2cfaf3eaff757b80e773.tar.xz | |
mac80211: add missing length check for confirm frames
Although mesh_rx_plink_frame() already checks that frames have enough
bytes for the action code plus another two bytes for capability/reason
code, it doesn't take into account that confirm frames also have an
additional two-byte aid. As a result, a corrupt frame could cause a
subsequent subtraction to wrap around to ill effect. Add another
check for this case.
Signed-off-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/mesh_plink.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index f17127e754c94..3b59099413fb1 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; + + if (baselen > len) + return; } ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); mesh_process_plink_frame(sdata, mgmt, &elems); |