Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp3617471pxb; Sat, 13 Feb 2021 03:53:25 -0800 (PST) X-Google-Smtp-Source: ABdhPJxg3fHAzHNCnOi1qeSUPJKD/Alv+3V7LkJr1a0saybuvib9oZhov9Ki4yo12+a2lijZmi+T X-Received: by 2002:a17:906:b291:: with SMTP id q17mr929190ejz.221.1613217204816; Sat, 13 Feb 2021 03:53:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1613217204; cv=none; d=google.com; s=arc-20160816; b=tE/2ndqQksxXJu+ZDgFEWpyKifAzzVvGFOysI4Fv2L2xFGoJUUWEIw8yFTIUxiuDnf ucNtCt97VsPFuDXNrKOGN8R8bsrpUpuePi8sBTdY4gPAY9qd9trdmrL5qazUE2l3Q3S7 k+Vdqx3u9Nqun0GqehrLYNhEq65ctjYDGlnq+ucttKO8boYxhUAWhtHeYDEfCj5fJ0BF dGWzL1wrCju0tVdPu1YSYZm/ee4CWLsHrIONHbW6RyiSD9iRv7T8eDsnBhh3UZAC5oMo ptA28SNyjm0GV6Eic2YEPD8dxJbga5hWZROn3WXViJcCTBwSAqwTzcPDc0FVlrucpJn4 b71Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=YhLBgope97+blWNsypl/y+UvYO6KSHPG0IFrmH+ZFts=; b=nppwFDXHYocRj4mrAa+1C9clFJglgCxNkN12VW/YNoowbxzNXxeOLedoZy7FW3mlLz sTw+2ApvP8tshRrm1QPIC3t0TZVhoa0wq0dHt1Zzz9kRJw+py5xQxmP5Jy6orTwVKomA yOvvS9G7tgSQ5kMwlGhlYYxB3BH/LKuXiYpB+RLrvzVX+ZlyZSGjo2GUIV3o8LTMCAQ/ tYiCotClhvHGj4wvkB2Tvjnrj/e2EGT3V6WnZSfV6P5+5fqX89vhexGHc1lg31ZQngf7 DidfzGcx8JnXv53TnOP3izIb1uzR2lW/9lXpGaF42r3NzMvfyMQAAOzec6xXDfv8kLG5 y38w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id gt35si7831264ejc.246.2021.02.13.03.52.46; Sat, 13 Feb 2021 03:53:24 -0800 (PST) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229574AbhBMLtp (ORCPT + 99 others); Sat, 13 Feb 2021 06:49:45 -0500 Received: from smail.rz.tu-ilmenau.de ([141.24.186.67]:52873 "EHLO smail.rz.tu-ilmenau.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229517AbhBMLto (ORCPT ); Sat, 13 Feb 2021 06:49:44 -0500 Received: from legolas.fritz.box (unknown [84.174.249.156]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smail.rz.tu-ilmenau.de (Postfix) with ESMTPSA id E7E5558004F; Sat, 13 Feb 2021 12:49:02 +0100 (CET) From: Markus Theil To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Markus Theil Subject: [PATCH] iw: fix pointer arithmetic in __print_he_capa Date: Sat, 13 Feb 2021 12:48:53 +0100 Message-Id: <20210213114853.17276-1-markus.theil@tu-ilmenau.de> X-Mailer: git-send-email 2.30.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Found by fuzzing with clang fuzzer. Signed-off-by: Markus Theil --- util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.c b/util.c index 12ba218..9f21f5f 100644 --- a/util.c +++ b/util.c @@ -1160,7 +1160,7 @@ static void __print_he_capa(const __u16 *mac_cap, /* Caller didn't provide ppet; infer it, if there's trailing space. */ if (!ppet) { - ppet = (const void *)(mcs_set + mcs_used); + ppet = (const void *)((const __u8 *)mcs_set + mcs_used); if (mcs_used < mcs_len) ppet_len = mcs_len - mcs_used; else -- 2.30.1