| Message ID | 1436877119-17577-3-git-send-email-me@bobcopeland.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Johannes Berg |
| Headers | show |
On Tue, 2015-07-14 at 08:31 -0400, Bob Copeland wrote: > Although mesh_rx_plink_frame() already checks that frames have enough > bytes for the action code plus another two bytes for > capability/reason > code, it doesn't take into account that confirm frames also have an > additional two-byte aid. As a result, a corrupt frame could cause a > subsequent subtraction to wrap around to ill effect. Add another > check for this case. > Also applied. johannes -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index 956384087e12..ac1029f28133 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -1123,6 +1123,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; + + if (baselen > len) + return; } ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); mesh_process_plink_frame(sdata, mgmt, &elems);
Although mesh_rx_plink_frame() already checks that frames have enough bytes for the action code plus another two bytes for capability/reason code, it doesn't take into account that confirm frames also have an additional two-byte aid. As a result, a corrupt frame could cause a subsequent subtraction to wrap around to ill effect. Add another check for this case. Signed-off-by: Bob Copeland <me@bobcopeland.com> --- v3: newly introduced net/mac80211/mesh_plink.c | 3 +++ 1 file changed, 3 insertions(+)