mirror of
https://git.kernel.org/pub/scm/network/wireless/iwd.git
synced 2025-02-19 18:40:44 +01:00

NLMSG_OK and NLMSG_NEXT expect to operate on nlmsg_len which is an int (signed type). The current code uses an unsigned type which means that it cannot detect underflows. Such underflows can happen when NLMSG_NEXT tries to advance nlmsg_len by a number of bytes (due to alignment) which are greater than the current nlmsg_len itself. This causes iwmon to crash on certain messages. Reported-By: Daniel Wagner <wagi@monom.org>