diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2012-09-05 13:07:00 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-09-06 17:11:00 +0200 |
| commit | 761a48d2603c0ff48024bc70c129b00ec37639ed (patch) | |
| tree | a445a44200d62a5304335dd31be3e3d9a44289f1 | |
| parent | f8fffc7e51462f51ffca6d0df505ef16afee2fb6 (diff) | |
| download | linux-761a48d2603c0ff48024bc70c129b00ec37639ed.tar.gz linux-761a48d2603c0ff48024bc70c129b00ec37639ed.tar.bz2 linux-761a48d2603c0ff48024bc70c129b00ec37639ed.zip | |
mac80211: check power constraint IE size when parsing
The power constraint IE is always a single byte
so check the size when parsing instead of later.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/ieee80211_i.h | 1 | ||||
| -rw-r--r-- | net/mac80211/mlme.c | 10 | ||||
| -rw-r--r-- | net/mac80211/util.c | 5 |
3 files changed, 6 insertions, 10 deletions
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index e2ab03c773e3..b95fa256d438 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1165,7 +1165,6 @@ struct ieee802_11_elems { u8 prep_len; u8 perr_len; u8 country_elem_len; - u8 pwr_constr_elem_len; u8 quiet_elem_len; u8 num_of_quiet_elem; /* can be more the one */ u8 timeout_int_len; diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 6e374cb04af6..87466942fa82 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -821,18 +821,13 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata, } static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata, - u16 capab_info, u8 *pwr_constr_elem, - u8 pwr_constr_elem_len) + u16 capab_info, u8 *pwr_constr_elem) { struct ieee80211_conf *conf = &sdata->local->hw.conf; if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT)) return; - /* Power constraint IE length should be 1 octet */ - if (pwr_constr_elem_len != 1) - return; - if ((*pwr_constr_elem <= conf->channel->max_reg_power) && (*pwr_constr_elem != sdata->local->power_constr_level)) { sdata->local->power_constr_level = *pwr_constr_elem; @@ -2552,8 +2547,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, if (elems.pwr_constr_elem) ieee80211_handle_pwr_constr(sdata, le16_to_cpu(mgmt->u.probe_resp.capab_info), - elems.pwr_constr_elem, - elems.pwr_constr_elem_len); + elems.pwr_constr_elem); } ieee80211_bss_info_change_notify(sdata, changed); diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 471fb0516c99..ed7543960b16 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len, elems->country_elem_len = elen; break; case WLAN_EID_PWR_CONSTRAINT: + if (elen != 1) { + elem_parse_failed = true; + break; + } elems->pwr_constr_elem = pos; - elems->pwr_constr_elem_len = elen; break; case WLAN_EID_TIMEOUT_INTERVAL: elems->timeout_int = pos; |