wifi: cfg80211: ensure length byte is present before access

When iterating the elements here, ensure the length byte is
present before checking it to see if the entire element will
fit into the buffer.

Longer term, we should rewrite this code using the type-safe
element iteration macros that check all of this.

Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 5dab33e1f3a819f852bca175ce24e53797f0889d..a183f2b758742d94e47acd3a0e65db08b2994c9d 100644 (file)
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -304,7 +304,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
        tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
        tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
 
-       while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
+       while (tmp_old + 2 - ie <= ielen &&
+              tmp_old + tmp_old[1] + 2 - ie <= ielen) {
                if (tmp_old[0] == 0) {
                        tmp_old++;
                        continue;
@@ -364,7 +365,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
         * copied to new ie, skip ssid, capability, bssid-index ie
         */
        tmp_new = sub_copy;
-       while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
+       while (tmp_new + 2 - sub_copy <= subie_len &&
+              tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
                if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
                      tmp_new[0] == WLAN_EID_SSID)) {
                        memcpy(pos, tmp_new, tmp_new[1] + 2);