3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-11-29 22:19:23 +01:00

ie: Error in tlv_iter_next if no space to length byte

When parsing the EAPoL-Key key data field we don't strip the 0xdd /
0x00 padding from the decrypted data so there may be trailing padding
after the IE sequence and valgrind will report an invalid read of the
length byte.  Same thing may happen if we're sent garbage.
This commit is contained in:
Andrew Zaborowski 2016-09-06 23:43:31 +02:00 committed by Denis Kenzior
parent 4a00c25241
commit 316752c5e4

View File

@ -57,7 +57,7 @@ bool ie_tlv_iter_next(struct ie_tlv_iter *iter)
unsigned int tag;
unsigned int len;
if (iter->pos >= iter->max)
if (iter->pos + 1 >= iter->max)
return false;
tag = *tlv++;