From: Markus Theil <markus.theil@tu-ilmenau.de>
Date: Sun, 9 Feb 2020 16:58:59 +0000 (+0100)
Subject: iw: scan: fix buffer over-read in print_wifi_wps
X-Git-Tag: v5.8~39
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e4ebc4622813103b16edc425f593f03d9ae07e5d;p=thirdparty%2Fiw.git

iw: scan: fix buffer over-read in print_wifi_wps

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20200209165902.44110-6-markus.theil@tu-ilmenau.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---

diff --git a/scan.c b/scan.c
index e8a7afd..2114cfe 100644
--- a/scan.c
+++ b/scan.c
@@ -1827,7 +1827,7 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 	while (len >= 4) {
 		subtype = (data[0] << 8) + data[1];
 		sublen = (data[2] << 8) + data[3];
-		if (sublen > len)
+		if (sublen > len - 4)
 			break;
 
 		switch (subtype) {