OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
1c636f8016
linux/net/wireless
History
Johannes Berg f5563318ff wireless: radiotap: fix parsing buffer overrun 
When parsing an invalid radiotap header, the parser can overrun
the buffer that is passed in because it doesn't correctly check
 1) the minimum radiotap header size
 2) the space for extended bitmaps

The first issue doesn't affect any in-kernel user as they all
check the minimum size before calling the radiotap function.
The second issue could potentially affect the kernel if an skb
is passed in that consists only of the radiotap header with a
lot of extended bitmaps that extend past the SKB. In that case
a read-only buffer overrun by at most 4 bytes is possible.

Fix this by adding the appropriate checks to the parser.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-10-14 09:47:00 +02:00
..
.gitignore wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
ap.c cfg80211: move exported event functions into nl80211 2013-03-06 16:35:46 +01:00
chan.c nl80211/cfg80211: add 5 and 10 MHz defines and wiphy flag 2013-06-18 16:06:50 +02:00
core.c cfg80211: don't add p2p device while in RFKILL 2013-10-09 18:40:16 +02:00
core.h cfg80211: don't add p2p device while in RFKILL 2013-10-09 18:40:16 +02:00
db.txt wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
debugfs.c cfg80211: vastly simplify locking 2013-05-25 00:02:15 +02:00
debugfs.h cfg80211/mac80211: use debugfs_remove_recursive 2009-10-30 16:49:18 -04:00
ethtool.c ethtool: fix drvinfo strings set in drivers 2013-01-06 21:06:31 -08:00
ethtool.h net/wireless/ethtool.h: drop unnecessary include of linux/ethtool.h 2009-10-07 16:39:49 -04:00
genregdb.awk cfg80211: relicense reg.c reg.h and genregdb.awk to ISC 2012-01-04 14:30:41 -05:00
ibss.c cfg80211: fix warning when using WEXT for IBSS 2013-09-26 19:43:14 +02:00
Kconfig lib80211: hide Kconfig symbol 2012-11-16 14:29:09 -05:00
lib80211_crypt_ccmp.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211_crypt_tkip.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211_crypt_wep.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211.c lib80211: remove exports for functions not called by other modules 2011-08-09 15:42:36 -04:00
Makefile cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
mesh.c cfg80211/mac80211: get mandatory rates based on scan width 2013-07-16 09:58:07 +03:00
mlme.c cfg80211: add flags to cfg80211_rx_mgmt() 2013-08-23 16:06:03 +02:00
nl80211.c cfg80211: use the correct macro to check for active monitor support 2013-09-26 13:22:45 +02:00
nl80211.h cfg80211: add flags to cfg80211_rx_mgmt() 2013-08-23 16:06:03 +02:00
radiotap.c wireless: radiotap: fix parsing buffer overrun 2013-10-14 09:47:00 +02:00
rdev-ops.h cfg80211: add wdev to testmode cmd 2013-08-12 14:11:37 +02:00
reg.c regulatory: use correct regulatory initiator on wiphy register 2013-07-25 09:52:46 +02:00
reg.h regulatory: use RCU to protect global and wiphy regdomains 2013-01-03 13:01:29 +01:00
regdb.h cfg80211: relicense reg.c reg.h and genregdb.awk to ISC 2012-01-04 14:30:41 -05:00
scan.c wireless: scan: Remove comment to compare_ether_addr 2013-09-03 22:34:48 -04:00
sme.c cfg80211: don't request disconnect if not connected 2013-08-14 14:00:19 +02:00
sysfs.c net: wireless: convert class code to use dev_groups 2013-07-25 16:34:40 -07:00
sysfs.h
trace.c cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
trace.h cfg80211: add wdev to testmode cmd 2013-08-12 14:11:37 +02:00
util.c cfg80211/mac80211: get mandatory rates based on scan width 2013-07-16 09:58:07 +03:00
wext-compat.c cfg80211: vastly simplify locking 2013-05-25 00:02:15 +02:00
wext-compat.h cfg80211: remove unused wext handler exports 2011-08-08 14:26:29 -04:00
wext-core.c wext: include wireless event id when it has a size problem 2012-09-05 16:12:44 +02:00
wext-priv.c wext: fix potential private ioctl memory content leak 2010-09-20 13:41:40 -04:00
wext-proc.c net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
wext-sme.c cfg80211: separate internal SME implementation 2013-06-04 13:03:11 +02:00
wext-spy.c wireless: Convert compare_ether_addr to ether_addr_equal 2012-05-09 20:49:19 -04:00