diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2012-03-01 10:02:08 +0300 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2012-03-05 15:23:15 -0500 |
| commit | 41eedf39dfb145fb8fa04cd5b799f7bdc7679696 (patch) | |
| tree | 359897e247fc8112046abae3540759eea33213e2 /kernel/timer.c | |
| parent | {nl,cfg,mac}80211: Implement RSSI threshold for mesh peering (diff) | |
rndis_wlan: integer overflows in rndis_wlan_do_link_up_work()
If "offset" is negative then we can get past this check:
if (offset > CONTROL_BUFFER_SIZE)
Or if we pick a very high "req_ie_len" then we can get around the check:
if (offset + req_ie_len > CONTROL_BUFFER_SIZE)
I made "resp_ie_len" and "req_ie_len" unsigned. I don't know if it was
intentional that they were signed in the original.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'kernel/timer.c')
0 files changed, 0 insertions, 0 deletions