linux/net/wireless
Johannes Berg bd02cd2549 radiotap: fix bitmap-end-finding buffer overrun
Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 12:06:43 +01:00
..
.gitignore wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
ap.c cfg80211: move exported event functions into nl80211 2013-03-06 16:35:46 +01:00
chan.c nl80211/cfg80211: enable DFS for IBSS mode 2013-10-28 15:05:21 +01:00
core.c cfg80211: disable CSA for all drivers 2013-12-02 11:53:44 +01:00
core.h Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless 2013-11-04 14:45:14 -05:00
db.txt wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
debugfs.c mac80211: fix some snprintf misuses 2013-10-01 12:16:51 +02:00
debugfs.h
ethtool.c ethtool: fix drvinfo strings set in drivers 2013-01-06 21:06:31 -08:00
ethtool.h
genregdb.awk cfg80211: parse dfs region for internal regdb option 2013-10-01 12:18:36 +02:00
ibss.c cfg80211: fix ibss wext chandef creation 2013-11-25 16:50:02 +01:00
Kconfig lib80211: hide Kconfig symbol 2012-11-16 14:29:09 -05:00
lib80211_crypt_ccmp.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211_crypt_tkip.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211_crypt_wep.c hostap: Don't use create_proc_read_entry() 2013-04-29 15:41:56 -04:00
lib80211.c lib80211: remove exports for functions not called by other modules 2011-08-09 15:42:36 -04:00
Makefile cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
mesh.c cfg80211/mac80211: get mandatory rates based on scan width 2013-07-16 09:58:07 +03:00
mlme.c cfg80211: update dfs_state_entered upon dfs_state change 2013-10-21 14:50:27 +02:00
nl80211.c cfg80211: ignore supported rates for nonexistant bands on scan 2013-11-25 16:54:26 +01:00
nl80211.h cfg80211: add flags to cfg80211_rx_mgmt() 2013-08-23 16:06:03 +02:00
radiotap.c radiotap: fix bitmap-end-finding buffer overrun 2013-12-16 12:06:43 +01:00
rdev-ops.h cfg80211: add wdev to testmode cmd 2013-08-12 14:11:37 +02:00
reg.c cfg80211: export reg_initiator_name() 2013-10-28 15:05:27 +01:00
reg.h cfg80211: rename regulatory_hint_11d() to regulatory_hint_country_ie() 2013-10-09 09:37:57 +02:00
regdb.h cfg80211: relicense reg.c reg.h and genregdb.awk to ISC 2012-01-04 14:30:41 -05:00
scan.c cfg80211: fix scheduled scan pointer access 2013-10-21 11:59:15 +02:00
sme.c cfg80211: fix WARN_ON for re-association to the expired BSS 2013-12-05 15:00:29 +01:00
sysfs.c net: wireless: convert class code to use dev_groups 2013-07-25 16:34:40 -07:00
sysfs.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
trace.c cfg80211: add tracing to rdev-ops 2012-10-18 10:53:37 +02:00
trace.h cfg80211: add wdev to testmode cmd 2013-08-12 14:11:37 +02:00
util.c nl80211/cfg80211: enable DFS for IBSS mode 2013-10-28 15:05:21 +01:00
wext-compat.c cfg80211: vastly simplify locking 2013-05-25 00:02:15 +02:00
wext-compat.h cfg80211: remove unused wext handler exports 2011-08-08 14:26:29 -04:00
wext-core.c wext: include wireless event id when it has a size problem 2012-09-05 16:12:44 +02:00
wext-priv.c wext: fix potential private ioctl memory content leak 2010-09-20 13:41:40 -04:00
wext-proc.c net: proc: change proc_net_remove to remove_proc_entry 2013-02-18 14:53:08 -05:00
wext-sme.c cfg80211: separate internal SME implementation 2013-06-04 13:03:11 +02:00
wext-spy.c wireless: Convert compare_ether_addr to ether_addr_equal 2012-05-09 20:49:19 -04:00