aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLuciano Coelho <coelho@ti.com>2011-06-07 13:42:26 -0400
committerJohn W. Linville <linville@tuxdriver.com>2011-06-07 14:19:07 -0400
commit57a27e1d6a3bb9ad4efeebd3a8c71156d6207536 (patch)
tree2873dc389e21115f1b674134baf1fae0ecdbb087
parent6633d649788e72400b02098bd389585e2c56a557 (diff)
nl80211: fix overflow in ssid_len
When one of the SSID's length passed in a scan or sched_scan request is larger than 255, there will be an overflow in the u8 that is used to store the length before checking. This causes the check to fail and we overrun the buffer when copying the SSID. Fix this by checking the nl80211 attribute length before copying it to the struct. This is a follow up for the previous commit 208c72f4fe44fe09577e7975ba0e7fa0278f3d03, which didn't fix the problem entirely. Reported-by: Ido Yariv <ido@wizery.com> Signed-off-by: Luciano Coelho <coelho@ti.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--net/wireless/nl80211.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 88a565f130a5..98fa8eb6cc4b 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3406,11 +3406,11 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3406 i = 0; 3406 i = 0;
3407 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { 3407 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3408 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 3408 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3409 request->ssids[i].ssid_len = nla_len(attr); 3409 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3410 if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3411 err = -EINVAL; 3410 err = -EINVAL;
3412 goto out_free; 3411 goto out_free;
3413 } 3412 }
3413 request->ssids[i].ssid_len = nla_len(attr);
3414 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 3414 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3415 i++; 3415 i++;
3416 } 3416 }
@@ -3572,12 +3572,11 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
3572 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { 3572 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3573 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], 3573 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
3574 tmp) { 3574 tmp) {
3575 request->ssids[i].ssid_len = nla_len(attr); 3575 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
3576 if (request->ssids[i].ssid_len >
3577 IEEE80211_MAX_SSID_LEN) {
3578 err = -EINVAL; 3576 err = -EINVAL;
3579 goto out_free; 3577 goto out_free;
3580 } 3578 }
3579 request->ssids[i].ssid_len = nla_len(attr);
3581 memcpy(request->ssids[i].ssid, nla_data(attr), 3580 memcpy(request->ssids[i].ssid, nla_data(attr),
3582 nla_len(attr)); 3581 nla_len(attr));
3583 i++; 3582 i++;