mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-28 07:13:34 +00:00
wifi: cfg80211: validate HE operation element parsing
commit4dc3a3893d
upstream. Validate that the HE operation element has the correct length before parsing it. Cc: stable@vger.kernel.org Fixes:645f3d8512
("wifi: cfg80211: handle UHB AP and STA power type") Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com> Link: https://msgid.link/20240523120533.677025eb4a92.I44c091029ef113c294e8fe8b9bf871bf5dbeeb27@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
fad7edbd7f
commit
f15e3e13e1
1 changed files with 2 additions and 1 deletions
|
@ -2128,7 +2128,8 @@ static bool cfg80211_6ghz_power_type_valid(const u8 *ie, size_t ielen,
|
|||
struct ieee80211_he_operation *he_oper;
|
||||
|
||||
tmp = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ie, ielen);
|
||||
if (tmp && tmp->datalen >= sizeof(*he_oper) + 1) {
|
||||
if (tmp && tmp->datalen >= sizeof(*he_oper) + 1 &&
|
||||
tmp->datalen >= ieee80211_he_oper_size(tmp->data + 1)) {
|
||||
const struct ieee80211_he_6ghz_oper *he_6ghz_oper;
|
||||
|
||||
he_oper = (void *)&tmp->data[1];
|
||||
|
|
Loading…
Reference in a new issue