git://ftp.safe.ca / safe / jmp / linux-2.6 / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 87bf24f) | patch
libertas: fix buffer overrun
authorJohannes Berg <johannes@sipsolutions.net>
Wed, 29 Oct 2008 10:43:32 +0000 (11:43 +0100)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 29 Oct 2008 21:54:35 +0000 (17:54 -0400)
commit48735d8d8bd701b1e0cd3d49c21e5e385ddcb077
tree73d969f41bbe0a10d01bebcaf9e90796a483db61tree | snapshot
parent87bf24f3d2e076468deaa5181d44184887072904commit | diff
libertas: fix buffer overrun

If somebody sends an invalid beacon/probe response, that can trash the
whole BSS descriptor. The descriptor is, luckily, large enough so that
it cannot scribble past the end of it; it's well above 400 bytes long.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org [2.6.24-2.6.27, bug present in some form since driver was added (2.6.22)]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/libertas/scan.c diff | blob | history
Full containers within linux kernel