Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp2854486ybv; Sun, 9 Feb 2020 09:01:27 -0800 (PST) X-Google-Smtp-Source: APXvYqy1QMgOWsrT1ERNXILa/kABj3gsjrIPM0o3yQPXkB/IgHQoPYtqC8dzfs/o87/NGYc+ve50 X-Received: by 2002:aca:53c6:: with SMTP id h189mr8429826oib.11.1581267686892; Sun, 09 Feb 2020 09:01:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581267686; cv=none; d=google.com; s=arc-20160816; b=MkCap0K6sB18KZXLSE/iMeH5ppAuSMRAX4cE0Ru3BKev69Tk6dMvGt+IoYUu+9GKSu Px9ZL3Uzv42ap8ccs0OAHD+SMelJXI2ZpfzuYXBUlQsYoGwLpuQQs4ioAUzzhoD6l8A5 ghgCUFl24zM7bo1OSyB/LcwgmyfiAdCCXKiYTn/cJzF4LPdMxT3FbLwdYseIaMBDnivC hBdMJfDck63BxwYAwQNQBrbmx38lqyBcPUnAN3rx0AW10i+OK+Dj8/93koS9zzqStvXu HnghRG+pcR0McvNLJucfo4OP6HnnYxsf4Jj+qQqsfXk3f+8jezKRPMLhJMjuOrp2FjHH +fLQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=D2IYbUtTPpGlhLACzEcS9mtc9JY8hTyNjYzraESYRmg=; b=JzMOl0TElPu0X2vK0O41lmaGATdJeZUvamysrpkC1UafbgsqGqwMT1UBDUIEFS5X2Z 6IQwKQ6/fdvHkh1q9u3WivJT4KnLHfZK5IzF/6ud892UzLideV/UrQoaU13+/vCq373N gyXyfNO5Fki1FbOx6ALQycSVT3rSSI0s4vVNfvq7xEP9GoIvGhIWqZ6RTWy8/QB32ERZ JFO0Xu4AgITorbj0iHozXsDhpUvT/59WZBU2SFiakMFqFJboDuX5LQsGV4J6BUQ08OC4 nOwFanpK/KsN4xaUXlEnDaSAnQdnCdd29xW9rapFE83CasaBITyqC6dfBJyuEMyUYkBD 9XTg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n2si3250858otq.315.2020.02.09.09.01.16; Sun, 09 Feb 2020 09:01:26 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727875AbgBIQ7S (ORCPT + 99 others); Sun, 9 Feb 2020 11:59:18 -0500 Received: from smail.rz.tu-ilmenau.de ([141.24.186.67]:49180 "EHLO smail.rz.tu-ilmenau.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727850AbgBIQ7R (ORCPT ); Sun, 9 Feb 2020 11:59:17 -0500 Received: from isengard.fritz.box (unknown [84.174.247.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smail.rz.tu-ilmenau.de (Postfix) with ESMTPSA id 09B94580075; Sun, 9 Feb 2020 17:59:14 +0100 (CET) From: Markus Theil To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Markus Theil Subject: [PATCH 5/8] iw: scan: fix buffer over-read in print_wifi_wps Date: Sun, 9 Feb 2020 17:58:59 +0100 Message-Id: <20200209165902.44110-6-markus.theil@tu-ilmenau.de> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200209165902.44110-1-markus.theil@tu-ilmenau.de> References: <20200209165902.44110-1-markus.theil@tu-ilmenau.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Signed-off-by: Markus Theil --- scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scan.c b/scan.c index 9a02363..f57925d 100644 --- a/scan.c +++ b/scan.c @@ -1818,7 +1818,7 @@ static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data, while (len >= 4) { subtype = (data[0] << 8) + data[1]; sublen = (data[2] << 8) + data[3]; - if (sublen > len) + if (sublen > len - 4) break; switch (subtype) { -- 2.25.0