diff options
| author | Johannes Berg <[email protected]> | 2013-12-16 12:04:36 +0100 |
|---|---|---|
| committer | Johannes Berg <[email protected]> | 2013-12-16 12:06:43 +0100 |
| commit | bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575 (patch) | |
| tree | d43aaa563d7e977e8b8122777baef54930528049 /net/lapb/lapb_out.c | |
| parent | 4c4d684a55fc01dac6bee696efc56b96d0e6c03a (diff) | |
radiotap: fix bitmap-end-finding buffer overrun
Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.
Cc: [email protected]
Reported-by: Evan Huus <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>
Diffstat (limited to 'net/lapb/lapb_out.c')
0 files changed, 0 insertions, 0 deletions