lkml.org 
[lkml]   [2014]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.8 113/166] radiotap: fix bitmap-end-finding buffer overrun
    Date
    3.8.13.16 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johannes Berg <johannes.berg@intel.com>

    commit bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 upstream.

    Evan Huus found (by fuzzing in wireshark) that the radiotap
    iterator code can access beyond the length of the buffer if
    the first bitmap claims an extension but then there's no
    data at all. Fix this.

    Reported-by: Evan Huus <eapache@gmail.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    net/wireless/radiotap.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
    index a271c27..722da61 100644
    --- a/net/wireless/radiotap.c
    +++ b/net/wireless/radiotap.c
    @@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init(
    /* find payload start allowing for extended bitmap(s) */

    if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
    + if ((unsigned long)iterator->_arg -
    + (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
    + (unsigned long)iterator->_max_length)
    + return -EINVAL;
    while (get_unaligned_le32(iterator->_arg) &
    (1 << IEEE80211_RADIOTAP_EXT)) {
    iterator->_arg += sizeof(uint32_t);
    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-01-16 00:21    [W:4.014 / U:0.188 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site