Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-27 10:52:47 +01:00
Code Releases Activity

ie: Error in tlv_iter_next if no space to length byte

Browse Source 
When parsing the EAPoL-Key key data field we don't strip the 0xdd /
0x00 padding from the decrypted data so there may be trailing padding
after the IE sequence and valgrind will report an invalid read of the
length byte.  Same thing may happen if we're sent garbage.
This commit is contained in:
Andrew Zaborowski 2016-09-06 23:43:31 +02:00 committed by Denis Kenzior
parent 4a00c25241
commit 316752c5e4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/ie.c
View File

@ -57,7 +57,7 @@ bool ie_tlv_iter_next(struct ie_tlv_iter *iter)
unsigned int tag;
unsigned int len;
if (iter->pos >= iter->max)
if (iter->pos + 1 >= iter->max)
return false;
tag = *tlv++;