1. 26 11月, 2013 11 次提交
  2. 28 10月, 2013 5 次提交
  3. 21 10月, 2013 3 次提交
  4. 19 10月, 2013 1 次提交
  5. 14 10月, 2013 1 次提交
    • J
      wireless: radiotap: fix parsing buffer overrun · f5563318
      Johannes Berg 提交于
      When parsing an invalid radiotap header, the parser can overrun
      the buffer that is passed in because it doesn't correctly check
       1) the minimum radiotap header size
       2) the space for extended bitmaps
      
      The first issue doesn't affect any in-kernel user as they all
      check the minimum size before calling the radiotap function.
      The second issue could potentially affect the kernel if an skb
      is passed in that consists only of the radiotap header with a
      lot of extended bitmaps that extend past the SKB. In that case
      a read-only buffer overrun by at most 4 bytes is possible.
      
      Fix this by adding the appropriate checks to the parser.
      
      Cc: stable@vger.kernel.org
      Reported-by: NEvan Huus <eapache@gmail.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      f5563318
  6. 11 10月, 2013 3 次提交
  7. 10 10月, 2013 1 次提交
  8. 09 10月, 2013 1 次提交
  9. 02 10月, 2013 1 次提交
  10. 01 10月, 2013 4 次提交
  11. 27 9月, 2013 2 次提交
  12. 26 9月, 2013 3 次提交
  13. 04 9月, 2013 1 次提交
  14. 23 8月, 2013 1 次提交
  15. 14 8月, 2013 2 次提交