diff options
| author |   Johannes Berg <johannes.berg@intel.com> | 2012-09-05 13:07:00 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-09-06 17:11:00 +0200 |
| commit | 761a48d2603c0ff48024bc70c129b00ec37639ed (patch) | |
| tree | a445a44200d62a5304335dd31be3e3d9a44289f1 /net/mac80211/util.c | |
| parent | mac80211_hwsim: move module_init/exit (diff) | |
| download | linux-dev-761a48d2603c0ff48024bc70c129b00ec37639ed.tar.xz linux-dev-761a48d2603c0ff48024bc70c129b00ec37639ed.zip | |
mac80211: check power constraint IE size when parsing
The power constraint IE is always a single byte
so check the size when parsing instead of later.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/util.c')
| -rw-r--r-- | net/mac80211/util.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 471fb0516c99..ed7543960b16 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, elems->country_elem_len = elen; break; case WLAN_EID_PWR_CONSTRAINT: + if (elen != 1) { + elem_parse_failed = true; + break; + } elems->pwr_constr_elem = pos; - elems->pwr_constr_elem_len = elen; break; case WLAN_EID_TIMEOUT_INTERVAL: elems->timeout_int = pos; |