Commit b3e7de87 authored by Bob Copeland's avatar Bob Copeland Committed by Johannes Berg

mac80211: add missing length check for confirm frames

Although mesh_rx_plink_frame() already checks that frames have enough
bytes for the action code plus another two bytes for capability/reason
code, it doesn't take into account that confirm frames also have an
additional two-byte aid.  As a result, a corrupt frame could cause a
subsequent subtraction to wrap around to ill effect.  Add another
check for this case.
Signed-off-by: default avatarBob Copeland <me@bobcopeland.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 2ea752cd
...@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, ...@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
WLAN_SP_MESH_PEERING_CONFIRM) { WLAN_SP_MESH_PEERING_CONFIRM) {
baseaddr += 4; baseaddr += 4;
baselen += 4; baselen += 4;
if (baselen > len)
return;
} }
ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
mesh_process_plink_frame(sdata, mgmt, &elems); mesh_process_plink_frame(sdata, mgmt, &elems);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment