nl80211: fix overflow in ssid_len
authorLuciano Coelho <coelho@ti.com>
Tue, 7 Jun 2011 17:42:26 +0000 (20:42 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Tue, 7 Jun 2011 18:19:07 +0000 (14:19 -0400)
commit57a27e1d6a3bb9ad4efeebd3a8c71156d6207536
tree2873dc389e21115f1b674134baf1fae0ecdbb087
parent6633d649788e72400b02098bd389585e2c56a557
nl80211: fix overflow in ssid_len

When one of the SSID's length passed in a scan or sched_scan request
is larger than 255, there will be an overflow in the u8 that is used
to store the length before checking.  This causes the check to fail
and we overrun the buffer when copying the SSID.

Fix this by checking the nl80211 attribute length before copying it to
the struct.

This is a follow up for the previous commit
208c72f4fe44fe09577e7975ba0e7fa0278f3d03, which didn't fix the problem
entirely.

Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/wireless/nl80211.c