| From 6684e59aa3cf6cb7ebf04ea2953198500c93b0a9 Mon Sep 17 00:00:00 2001 |
| Message-ID: <4561E092.5030201@gentoo.org> |
| From: Laurent Riffard <laurent.riffard@free.fr> |
| Date: Thu, 12 Oct 2006 00:17:36 +0200 |
| Subject: softmac: fix a slab corruption in WEP restricted key association |
| |
| Fix a slab corruption in ieee80211softmac_auth(). The size of a buffer |
| was miscomputed. |
| |
| see http://bugzilla.kernel.org/show_bug.cgi?id=7245 |
| |
| Acked-by: Daniel Drake <dsd@gentoo.org> |
| Signed-off-by: Laurent Riffard <laurent.riffard@free.fr> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Chris Wright <chrisw@sous-sol.org> |
| --- |
| net/ieee80211/softmac/ieee80211softmac_io.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- linux-2.6.18.4.orig/net/ieee80211/softmac/ieee80211softmac_io.c |
| +++ linux-2.6.18.4/net/ieee80211/softmac/ieee80211softmac_io.c |
| @@ -304,7 +304,7 @@ ieee80211softmac_auth(struct ieee80211_a |
| 2 + /* Auth Transaction Seq */ |
| 2 + /* Status Code */ |
| /* Challenge Text IE */ |
| - is_shared_response ? 0 : 1 + 1 + net->challenge_len |
| + (is_shared_response ? 1 + 1 + net->challenge_len : 0) |
| ); |
| if (unlikely((*pkt) == NULL)) |
| return 0; |
