mirror of
https://github.com/torvalds/linux.git
synced 2026-09-20 19:01:02 +02:00
74ed3669f2
libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3. Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260705083519.23567-1-pengpeng@iscas.ac.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
|---|---|---|
| .. | ||
| ipw.h | ||
| ipw2100.c | ||
| ipw2100.h | ||
| ipw2200.c | ||
| ipw2200.h | ||
| Kconfig | ||
| libipw_crypto_ccmp.c | ||
| libipw_crypto_tkip.c | ||
| libipw_crypto_wep.c | ||
| libipw_crypto.c | ||
| libipw_geo.c | ||
| libipw_module.c | ||
| libipw_rx.c | ||
| libipw_spy.c | ||
| libipw_tx.c | ||
| libipw_wx.c | ||
| libipw.h | ||
| Makefile | ||