Changeset 1842

Timestamp:

12/07/06 14:17:50 (2 years ago)

Author:

mrenzmann

Message:

Fix buffer overflow issue that was exploitable locally and remote
for arbitrary kernel code injection. Thanks to Laurent Butti,
Jerome Raznieski and Julien Tinnes for reporting the issue.

Signed-off-by: Laurent BUTTI <laurent.butti@francetelecom.com>
Signed-off-by: Julien TINNES <julien.tinnes@francetelecom.com>

Files:

• trunk/net80211/ieee80211_wireless.c (modified) (4 diffs)

trunk/net80211/ieee80211_wireless.c

@@ -1566 +1566 @@
-        bufsize -= leader_len;
-        p += leader_len;
+        if (bufsize < ielen)
+                return 0;
-        for (i = 0; i < ielen && bufsize > 2; i++)
-                p += sprintf(p, "%02x", ie[i]);
@@ -1588 +1590 @@
-        char *last_ev;
-#if WIRELESS_EXT > 14
-
+
+
-#ifndef IWEVGENIE
-        static const char rsn_leader[] = "rsn_ie=";
@@ -1736 +1739 @@
-#ifdef IWEVGENIE
-                memset(&iwe, 0, sizeof(iwe));
+                if ((se->se_rsn_ie[1] + 2) > MAX_IE_LENGTH)
+                        return E2BIG;
-                memcpy(buf, se->se_rsn_ie, se->se_rsn_ie[1] + 2);
-                iwe.cmd = IWEVGENIE;
@@ -1761 +1766 @@
-#ifdef IWEVGENIE
-                memset(&iwe, 0, sizeof(iwe));
+                if ((se->se_wpa_ie[1] + 2) > MAX_IE_LENGTH)
+                        return E2BIG;
-                memcpy(buf, se->se_wpa_ie, se->se_wpa_ie[1] + 2);
-                iwe.cmd = IWEVGENIE;