diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2013-03-27 14:31:53 +0100 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-04-08 09:16:57 +0200 |
| commit | 1946bed95707ef75d85e94ebe106ce7a119ca831 (patch) | |
| tree | a0be226b4fed65ac75344222e70c2cdddb5b0888 /net/mac80211/util.c | |
| parent | mac80211: check DSSS params IE length in parser (diff) | |
| download | linux-1946bed95707ef75d85e94ebe106ce7a119ca831.tar.xz linux-1946bed95707ef75d85e94ebe106ce7a119ca831.zip | |
mac80211: check ERP info IE length in parser
It's always just one byte, so check for that and
remove the length field from the parser struct.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/util.c')
| -rw-r--r-- | net/mac80211/util.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 0f7d1c20f8ac..4839dec5c9ac 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -780,8 +780,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, elems->rsn_len = elen; break; case WLAN_EID_ERP_INFO: - elems->erp_info = pos; - elems->erp_info_len = elen; + if (elen >= 1) + elems->erp_info = pos; + else + elem_parse_failed = true; break; case WLAN_EID_EXT_SUPP_RATES: elems->ext_supp_rates = pos; |