summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBob Copeland <me@bobcopeland.com>2015-07-14 08:31:56 -0400
committerJohannes Berg <johannes.berg@intel.com>2015-07-17 14:39:42 +0200
commitb3e7de873df77c1fa0bc2cfaf3eaff757b80e773 (patch)
tree046c8fc8415179b2cf90c600176790dd385e75d8
parent2ea752cd2ce066c5d8c1807b5310ef329885cecb (diff)
mac80211: add missing length check for confirm frames
Although mesh_rx_plink_frame() already checks that frames have enough bytes for the action code plus another two bytes for capability/reason code, it doesn't take into account that confirm frames also have an additional two-byte aid. As a result, a corrupt frame could cause a subsequent subtraction to wrap around to ill effect. Add another check for this case. Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-rw-r--r--net/mac80211/mesh_plink.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index f17127e754c9..3b59099413fb 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
WLAN_SP_MESH_PEERING_CONFIRM) {
baseaddr += 4;
baselen += 4;
+
+ if (baselen > len)
+ return;
}
ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
mesh_process_plink_frame(sdata, mgmt, &elems);