Received: by 2002:a25:1506:0:0:0:0:0 with SMTP id 6csp2855673ybv; Sun, 9 Feb 2020 09:02:33 -0800 (PST) X-Google-Smtp-Source: APXvYqyD9ERTzPaqQpymURoAGZd/ExbhqU43FzECMCTPv8NA+U7Z6I85NAoJAR+yQAYtUdZqWitQ X-Received: by 2002:a05:6808:3ba:: with SMTP id n26mr8554799oie.62.1581267752980; Sun, 09 Feb 2020 09:02:32 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1581267752; cv=none; d=google.com; s=arc-20160816; b=H/ZdzyMO4bTOORr/zQGS6IrMwZwf8lri8S+FXThJXN9mtCNfc7ZTAS78HXfDDw6qCT mz0yltm9syulO+0mFC1jdw5p37soY8xwW7zc574ZlqOAEgoVykhxaeGy8YKeP0mn6yWy eVl89ubwCgI94GudXELNwrmGt2O8ysxkMOMVPh3G6bC+Rzl7DgBWADDuApCzxiGjpVr3 rxYdKen/8Oi5BkGjhhSe022wDWRXI5D/Ec30v8kJfNwVCUEtd3Y41xcusNwOyGBmvsLp WyZIBQj0A6tl3EvFPij5XYj7C4yeaedxQINZSJ8R6F8IziLbLTI9SXYCO7v/zLcW42My pJeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=UmrWJRACg/+jZhJgba5MfegwHaQmCDAEFfTuePWjE2A=; b=XI2bAM4HxEHhAAAkCCfjvLs7P7+dQWzwW4Zs3uD+j2pIfVQNxRffBnBaV2lv2oob95 OB4GeA5LbuAMI2irre5rQ50+Uic3m3FyqHo2GLCqfhSZjp0I6ZMIBkZ9VeFIltqmWTEb W0yXIxfFlYJ8rEX3t+nLH5edZjJ+W9v73GB961pNdI4qoy2T2Cnd3BCtjVakmjOhVixX cy0hEmW08fWDV8tG141tjv/Ac+Rigoxkuu2WYM6qftK1lANW59VNfktt2RGQ8ru4IajR KsYYkw+X80fMBbBtnVnZCKhWOo0GI561hJYOQ5d6swZYAksJuOo22LLBg8g5qqaxWsfb NkZQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q189si6819956oic.235.2020.02.09.09.02.22; Sun, 09 Feb 2020 09:02:32 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727878AbgBIQ7S (ORCPT + 99 others); Sun, 9 Feb 2020 11:59:18 -0500 Received: from smail.rz.tu-ilmenau.de ([141.24.186.67]:49181 "EHLO smail.rz.tu-ilmenau.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727768AbgBIQ7R (ORCPT ); Sun, 9 Feb 2020 11:59:17 -0500 Received: from isengard.fritz.box (unknown [84.174.247.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smail.rz.tu-ilmenau.de (Postfix) with ESMTPSA id 558B7580076; Sun, 9 Feb 2020 17:59:14 +0100 (CET) From: Markus Theil To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Markus Theil Subject: [PATCH 6/8] iw: scan: fix buffer over-read in print_p2p Date: Sun, 9 Feb 2020 17:59:00 +0100 Message-Id: <20200209165902.44110-7-markus.theil@tu-ilmenau.de> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200209165902.44110-1-markus.theil@tu-ilmenau.de> References: <20200209165902.44110-1-markus.theil@tu-ilmenau.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Signed-off-by: Markus Theil --- scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scan.c b/scan.c index f57925d..b3e7baa 100644 --- a/scan.c +++ b/scan.c @@ -2036,7 +2036,7 @@ static inline void print_p2p(const uint8_t type, uint8_t len, case 0x12: /* invitation flags */ case 0xdd: /* vendor specific */ default: { - const __u8 *subdata = data + 4; + const __u8 *subdata = data + 3; __u16 tmplen = sublen; tab_on_first(&first); -- 2.25.0