[PATCH 2.6.30] mac80211: validate TIM IE length

Johannes Berg
2009-04-16T22:54:58Z

when parsing it.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
---
Ok the other version doesn't apply to .30 -- only to a tree that already
has my other patches. This is going to create merge conflicts, but they
should be easy to resolve...

net/mac80211/mlme.c | 3 +++
1 file changed, 3 insertions(+)

--- wireless-testing.orig/net/mac80211/mlme.c 2009-04-17 00:50:23.000000000 +0200
+++ wireless-testing/net/mac80211/mlme.c 2009-04-17 00:52:09.000000000 +0200
@@ -528,6 +528,9 @@ static bool ieee80211_check_tim(struct i
u8 index, indexn1, indexn2;
struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;

+ if (unlikely(!tim || elems->tim_len < 4))
+ return false;
+
aid &= 0x3fff;
index = aid / 8;
mask = 1 << (aid & 7);