leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b2a0fa1520
linux/net/wireless
History
Luciano Coelho 57a27e1d6a nl80211: fix overflow in ssid_len 
When one of the SSID's length passed in a scan or sched_scan request
is larger than 255, there will be an overflow in the u8 that is used
to store the length before checking.  This causes the check to fail
and we overrun the buffer when copying the SSID.

Fix this by checking the nl80211 attribute length before copying it to
the struct.

This is a follow up for the previous commit
208c72f4fe, which didn't fix the problem
entirely.

Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-06-07 14:19:07 -04:00
..
.gitignore wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
chan.c cfg80211: fix can_beacon_sec_chan, reenable HT40 2010-11-18 11:35:05 -05:00
core.c cfg80211: advertise possible interface combinations 2011-05-16 14:10:40 -04:00
core.h cfg80211: Use consistent BSS matching between scan and sme 2011-05-19 10:37:18 -04:00
db.txt wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
debugfs.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
debugfs.h
ethtool.c wireless: add support for ethtool_ops->{get,set}_ringparam 2011-03-11 14:16:58 -05:00
ethtool.h
genregdb.awk wireless: correct sparse warning in generated regdb.c 2010-07-20 16:49:37 -04:00
ibss.c cfg80211/mac80211: allow per-station GTKs 2010-10-06 16:30:40 -04:00
Kconfig kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
lib80211_crypt_ccmp.c lib80211: remove unused host_build_iv option 2010-07-26 15:09:04 -04:00
lib80211_crypt_tkip.c net/wireless: Use pr_<level> and netdev_<level> 2010-11-24 16:19:33 -05:00
lib80211_crypt_wep.c wireless: Fix warnings due to -Wunused-but-set-variable 2011-05-10 15:53:47 -04:00
lib80211.c net/wireless: Use pr_<level> and netdev_<level> 2010-11-24 16:19:33 -05:00
Makefile cfg80211/mac80211: add mesh join/leave commands 2010-12-06 16:01:29 -05:00
mesh.c nl80211: New notification to discover mesh peer candidates. 2011-04-12 16:57:39 -04:00
mlme.c mac80211: Let userspace send action frames over mesh interfaces 2011-05-11 14:37:47 -04:00
nl80211.c nl80211: fix overflow in ssid_len 2011-06-07 14:19:07 -04:00
nl80211.h cfg80211/nl80211: add support for scheduled scans 2011-05-11 15:12:26 -04:00
radiotap.c radiotap: fix vendor namespace parsing 2010-10-15 15:57:34 -04:00
reg.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem 2011-05-16 19:32:19 -04:00
reg.h net/wireless: add COUNTRY to to regulatory device uevent 2011-03-09 16:10:57 -05:00
regdb.h wireless: support internal statically compiled regulatory database 2009-12-21 18:56:10 -05:00
scan.c cfg80211: don't drop p2p probe responses 2011-06-01 14:34:01 -04:00
sme.c cfg80211: Use consistent BSS matching between scan and sme 2011-05-19 10:37:18 -04:00
sysfs.c nl80211/cfg80211: WoWLAN support 2011-05-05 14:59:19 -04:00
sysfs.h
util.c cfg80211: Use consistent BSS matching between scan and sme 2011-05-19 10:37:18 -04:00
wext-compat.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2011-03-03 21:27:42 -08:00
wext-compat.h
wext-core.c net/wireless: Use pr_<level> and netdev_<level> 2010-11-24 16:19:33 -05:00
wext-priv.c wext: fix potential private ioctl memory content leak 2010-09-20 13:41:40 -04:00
wext-proc.c net: spread __net_init, __net_exit 2010-01-17 19:16:02 -08:00
wext-sme.c cfg80211: allow changing port control protocol 2010-08-27 13:27:07 -04:00
wext-spy.c