libertas: fix buffer overrun
If somebody sends an invalid beacon/probe response, that can trash the whole BSS descriptor. The descriptor is, luckily, large enough so that it cannot scribble past the end of it; it's well above 400 bytes long. Signed-off-by: NJohannes Berg <johannes@sipsolutions.net> Cc: stable@kernel.org [2.6.24-2.6.27, bug present in some form since driver was added (2.6.22)] Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
Showing
想要评论请 注册 或 登录