Revision 57a27e1d6a3bb9ad4efeebd3a8c71156d6207536 authored by Luciano Coelho on 07 June 2011, 17:42:26 UTC, committed by John W. Linville on 07 June 2011, 18:19:07 UTC
When one of the SSID's length passed in a scan or sched_scan request is larger than 255, there will be an overflow in the u8 that is used to store the length before checking. This causes the check to fail and we overrun the buffer when copying the SSID. Fix this by checking the nl80211 attribute length before copying it to the struct. This is a follow up for the previous commit 208c72f4fe44fe09577e7975ba0e7fa0278f3d03, which didn't fix the problem entirely. Reported-by: Ido Yariv <ido@wizery.com> Signed-off-by: Luciano Coelho <coelho@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
1 parent 6633d64
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .gitignore | -rw-r--r-- | 941 bytes |
| .mailmap | -rw-r--r-- | 4.1 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 91.7 KB |
| Kbuild | -rw-r--r-- | 2.4 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 188.7 KB |
| Makefile | -rw-r--r-- | 51.2 KB |
| README | -rw-r--r-- | 17.1 KB |
| REPORTING-BUGS | -rw-r--r-- | 3.3 KB |
Computing file changes ...
