mac80211: fix HT information element parsing

There's no checking that the HT IEs are of the right length
which can be used by an attacker to cause an out-of-bounds
access by sending a too short HT information/capability IE.
Fix it by simply pretending those IEs didn't exist when too
short.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index f32561ec224c..cee4884b9d06 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -529,12 +529,12 @@ void ieee802_11_parse_elems(u8 *start, size_t len,
                         elems->ext_supp_rates_len = elen;
                         break;
                 case WLAN_EID_HT_CAPABILITY:
-                        elems->ht_cap_elem = pos;
-                        elems->ht_cap_elem_len = elen;
+                        if (elen >= sizeof(struct ieee80211_ht_cap))
+                                elems->ht_cap_elem = (void *)pos;
                         break;
                 case WLAN_EID_HT_EXTRA_INFO:
-                        elems->ht_info_elem = pos;
-                        elems->ht_info_elem_len = elen;
+                        if (elen >= sizeof(struct ieee80211_ht_addt_info))
+                                elems->ht_info_elem = (void *)pos;
                         break;
                 case WLAN_EID_MESH_ID:
                         elems->mesh_id = pos;