mac80211: validate TIM IE length (redux)

The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it and use the proper type. To ease that adjust
struct ieee80211_tim_ie to have a virtual bitmap of size
at least 1.

Also check that the TIM IE is actually present before trying
to parse it!

Because other people may need the function, make it a static
inline in ieee80211.h.

(The original "mac80211: validate TIM IE length" was a minimal fix for
2.6.30.  This purports to be the full, correct fix. -- JWL)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 11244212f41d..61876eb50b49 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->cf_params_len = elen;
                         break;
                 case WLAN_EID_TIM:
-                        elems->tim = pos;
-                        elems->tim_len = elen;
+                        if (elen >= sizeof(struct ieee80211_tim_ie)) {
+                                elems->tim = (void *)pos;
+                                elems->tim_len = elen;
+                        }
                         break;
                 case WLAN_EID_IBSS_PARAMS:
                         elems->ibss_params = pos;