]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: cfg80211: fix buffer overflow in elem comparison
authorJohannes Berg <johannes.berg@intel.com>
Fri, 25 Nov 2022 11:36:57 +0000 (12:36 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Dec 2022 10:23:56 +0000 (11:23 +0100)
commit9e6b79a3cd17620d467311b30d56f2648f6880aa
treeab36a7dac59517d03f1c01fda10c0e5cc95a9376
parent6922948c2ec1cc45b11acb8ec2eeb3a8353d572b
wifi: cfg80211: fix buffer overflow in elem comparison

[ Upstream commit 9f16b5c82a025cd4c864737409234ddc44fb166a ]

For vendor elements, the code here assumes that 5 octets
are present without checking. Since the element itself is
already checked to fit, we only need to check the length.

Reported-and-tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/wireless/scan.c