1. 06 3月, 2008 1 次提交
  2. 29 1月, 2008 9 次提交
  3. 30 11月, 2007 1 次提交
  4. 21 11月, 2007 1 次提交
  5. 11 11月, 2007 1 次提交
  6. 07 11月, 2007 1 次提交
  7. 02 11月, 2007 1 次提交
  8. 24 10月, 2007 3 次提交
  9. 23 10月, 2007 1 次提交
  10. 20 10月, 2007 1 次提交
  11. 17 10月, 2007 1 次提交
  12. 11 10月, 2007 4 次提交
  13. 03 10月, 2007 1 次提交
  14. 02 10月, 2007 1 次提交
    • J
      [IEEE80211]: avoid integer underflow for runt rx frames · 04045f98
      John W. Linville 提交于
      Reported by Chris Evans <scarybeasts@gmail.com>:
      
      > The summary is that an evil 80211 frame can crash out a victim's
      > machine. It only applies to drivers using the 80211 wireless code, and
      > only then to certain drivers (and even then depends on a card's
      > firmware not dropping a dubious packet). I must confess I'm not
      > keeping track of Linux wireless support, and the different protocol
      > stacks etc.
      >
      > Details are as follows:
      >
      > ieee80211_rx() does not explicitly check that "skb->len >= hdrlen".
      > There are other skb->len checks, but not enough to prevent a subtle
      > off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag
      > set.
      >
      > This leads to integer underflow and crash here:
      >
      > if (frag != 0)
      >    flen -= hdrlen;
      >
      > (flen is subsequently used as a memcpy length parameter).
      
      How about this?
      Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      04045f98
  15. 21 9月, 2007 1 次提交
  16. 07 8月, 2007 1 次提交
  17. 18 7月, 2007 1 次提交
  18. 11 7月, 2007 1 次提交
  19. 09 7月, 2007 1 次提交
  20. 29 5月, 2007 2 次提交
  21. 08 5月, 2007 2 次提交
  22. 28 4月, 2007 3 次提交
  23. 26 4月, 2007 1 次提交