aboutsummaryrefslogtreecommitdiffstats
path: root/net/mac80211/util.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes@sipsolutions.net>2009-04-18 11:33:24 -0400
committerJohn W. Linville <linville@tuxdriver.com>2009-04-22 16:57:18 -0400
commite7ec86f54e519e8e86f1cf328db13263f3ef8bd4 (patch)
tree2b0a66930abf4ac710cc15120195c9259a0fcaba /net/mac80211/util.c
parentba44cb7226afd4e19308c1d8a90e8b7c566c0d8b (diff)
mac80211: validate TIM IE length (redux)
The TIM IE must not be shorter than 4 bytes, so verify that when parsing it and use the proper type. To ease that adjust struct ieee80211_tim_ie to have a virtual bitmap of size at least 1. Also check that the TIM IE is actually present before trying to parse it! Because other people may need the function, make it a static inline in ieee80211.h. (The original "mac80211: validate TIM IE length" was a minimal fix for 2.6.30. This purports to be the full, correct fix. -- JWL) Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/util.c')
-rw-r--r--net/mac80211/util.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 11244212f41d..61876eb50b49 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -588,8 +588,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
588 elems->cf_params_len = elen; 588 elems->cf_params_len = elen;
589 break; 589 break;
590 case WLAN_EID_TIM: 590 case WLAN_EID_TIM:
591 elems->tim = pos; 591 if (elen >= sizeof(struct ieee80211_tim_ie)) {
592 elems->tim_len = elen; 592 elems->tim = (void *)pos;
593 elems->tim_len = elen;
594 }
593 break; 595 break;
594 case WLAN_EID_IBSS_PARAMS: 596 case WLAN_EID_IBSS_PARAMS:
595 elems->ibss_params = pos; 597 elems->ibss_params = pos;