Johannes Berg a86f1d64f4 radiotap: fix bitmap-end-finding buffer overrun ...

commit bd02cd2549 upstream.

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2014-01-08 09:42:12 -08:00

..

.gitignore

…

chan.c

…

core.c

cfg80211: fix antenna gain handling

2012-11-17 13:15:56 -08:00

core.h

cfg80211: process pending events when unregistering net device

2012-08-15 08:10:32 -07:00

db.txt

…

debugfs.c

…

debugfs.h

…

ethtool.c

…

ethtool.h

…

genregdb.awk

…

ibss.c

…

Kconfig

…

lib80211_crypt_ccmp.c

…

lib80211_crypt_tkip.c

…

lib80211_crypt_wep.c

…

lib80211.c

…

Makefile

…

mesh.c

…

mlme.c

…

nl80211.c

nl80211: fix mgmt tx status and testmode reporting for netns

2013-08-11 15:38:41 -07:00

nl80211.h

…

radiotap.c

radiotap: fix bitmap-end-finding buffer overrun

2014-01-08 09:42:12 -08:00

reg.c

wireless: regulatory: fix channel disabling race condition

2013-05-07 19:51:56 -07:00

reg.h

…

regdb.h

…

scan.c

…

sme.c

…

sysfs.c

…

sysfs.h

…

util.c

mac80211: verify that skb data is present

2012-11-17 13:16:11 -08:00

wext-compat.c

…

wext-compat.h

…

wext-core.c

…

wext-priv.c

…

wext-proc.c

…

wext-sme.c

…

wext-spy.c

…