Johannes Berg bd02cd2549 radiotap: fix bitmap-end-finding buffer overrun ...

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2013-12-16 12:06:43 +01:00

..

.gitignore

wireless: support internal statically compiled regulatory database

2009-12-21 18:56:10 -05:00

ap.c

cfg80211: move exported event functions into nl80211

2013-03-06 16:35:46 +01:00

chan.c

nl80211/cfg80211: enable DFS for IBSS mode

2013-10-28 15:05:21 +01:00

core.c

cfg80211: disable CSA for all drivers

2013-12-02 11:53:44 +01:00

core.h

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

2013-11-04 14:45:14 -05:00

db.txt

wireless: support internal statically compiled regulatory database

2009-12-21 18:56:10 -05:00

debugfs.c

mac80211: fix some snprintf misuses

2013-10-01 12:16:51 +02:00

debugfs.h

cfg80211/mac80211: use debugfs_remove_recursive

2009-10-30 16:49:18 -04:00

ethtool.c

ethtool: fix drvinfo strings set in drivers

2013-01-06 21:06:31 -08:00

ethtool.h

net/wireless/ethtool.h: drop unnecessary include of linux/ethtool.h

2009-10-07 16:39:49 -04:00

genregdb.awk

cfg80211: parse dfs region for internal regdb option

2013-10-01 12:18:36 +02:00

ibss.c

cfg80211: fix ibss wext chandef creation

2013-11-25 16:50:02 +01:00

Kconfig

lib80211: hide Kconfig symbol

2012-11-16 14:29:09 -05:00

lib80211_crypt_ccmp.c

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

lib80211_crypt_tkip.c

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

lib80211_crypt_wep.c

hostap: Don't use create_proc_read_entry()

2013-04-29 15:41:56 -04:00

lib80211.c

lib80211: remove exports for functions not called by other modules

2011-08-09 15:42:36 -04:00

Makefile

cfg80211: add tracing to rdev-ops

2012-10-18 10:53:37 +02:00

mesh.c

cfg80211/mac80211: get mandatory rates based on scan width

2013-07-16 09:58:07 +03:00

mlme.c

cfg80211: update dfs_state_entered upon dfs_state change

2013-10-21 14:50:27 +02:00

nl80211.c

cfg80211: ignore supported rates for nonexistant bands on scan

2013-11-25 16:54:26 +01:00

nl80211.h

cfg80211: add flags to cfg80211_rx_mgmt()

2013-08-23 16:06:03 +02:00

radiotap.c

radiotap: fix bitmap-end-finding buffer overrun

2013-12-16 12:06:43 +01:00

rdev-ops.h

cfg80211: add wdev to testmode cmd

2013-08-12 14:11:37 +02:00

reg.c

cfg80211: export reg_initiator_name()

2013-10-28 15:05:27 +01:00

reg.h

cfg80211: rename regulatory_hint_11d() to regulatory_hint_country_ie()

2013-10-09 09:37:57 +02:00

regdb.h

cfg80211: relicense reg.c reg.h and genregdb.awk to ISC

2012-01-04 14:30:41 -05:00

scan.c

cfg80211: fix scheduled scan pointer access

2013-10-21 11:59:15 +02:00

sme.c

cfg80211: fix WARN_ON for re-association to the expired BSS

2013-12-05 15:00:29 +01:00

sysfs.c

net: wireless: convert class code to use dev_groups

2013-07-25 16:34:40 -07:00

sysfs.h

net: misc: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

trace.c

cfg80211: add tracing to rdev-ops

2012-10-18 10:53:37 +02:00

trace.h

cfg80211: add wdev to testmode cmd

2013-08-12 14:11:37 +02:00

util.c

nl80211/cfg80211: enable DFS for IBSS mode

2013-10-28 15:05:21 +01:00

wext-compat.c

cfg80211: vastly simplify locking

2013-05-25 00:02:15 +02:00

wext-compat.h

cfg80211: remove unused wext handler exports

2011-08-08 14:26:29 -04:00

wext-core.c

wext: include wireless event id when it has a size problem

2012-09-05 16:12:44 +02:00

wext-priv.c

wext: fix potential private ioctl memory content leak

2010-09-20 13:41:40 -04:00

wext-proc.c

net: proc: change proc_net_remove to remove_proc_entry

2013-02-18 14:53:08 -05:00

wext-sme.c

cfg80211: separate internal SME implementation

2013-06-04 13:03:11 +02:00

wext-spy.c

wireless: Convert compare_ether_addr to ether_addr_equal

2012-05-09 20:49:19 -04:00