diff options
| author | Benjamin Berg <benjamin.berg@intel.com> | 2024-03-18 18:53:28 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2024-03-25 15:38:14 +0100 |
| commit | c7378d7d8be0b44d03c990a2686e64d038c694a5 (patch) | |
| tree | b1bafd693dfeed3a356804f96d5e887e4d8c4fdb /net/wireless/scan.c | |
| parent | 0dfedd48ac539eb8d83e00830346a23a6e98f9f8 (diff) | |
wifi: cfg80211: check BSSID Index against MaxBSSID
Add a verification that the BSSID Index does not exceed the maximum
number of BSSIDs in the Multiple-BSSID set.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240318184907.a7574d415adc.I02f40c2920a9f602898190679cc27d0c8ee2c67d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless/scan.c')
| -rw-r--r-- | net/wireless/scan.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/scan.c b/net/wireless/scan.c index b55ffe73e1ef..8ac2d19d8ede 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2447,7 +2447,8 @@ cfg80211_parse_mbssid_data(struct wiphy *wiphy, profile, profile_len); if (!mbssid_index_ie || mbssid_index_ie[1] < 1 || mbssid_index_ie[2] == 0 || - mbssid_index_ie[2] > 46) { + mbssid_index_ie[2] > 46 || + mbssid_index_ie[2] >= (1 << elem->data[0])) { /* No valid Multiple BSSID-Index element */ continue; } |