[5/8] iw: scan: fix buffer over-read in print_wifi_wps
diff mbox series

Message ID 20200209165902.44110-6-markus.theil@tu-ilmenau.de
State Accepted
Delegated to: Johannes Berg
Headers show
Series
  • iw: parse measurement pilot and fix scan bugs
Related show

Commit Message

Markus Theil Feb. 9, 2020, 4:58 p.m. UTC
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
---
 scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch
diff mbox series

diff --git a/scan.c b/scan.c
index 9a02363..f57925d 100644
--- a/scan.c
+++ b/scan.c
@@ -1818,7 +1818,7 @@  static void print_wifi_wps(const uint8_t type, uint8_t len, const uint8_t *data,
 	while (len >= 4) {
 		subtype = (data[0] << 8) + data[1];
 		sublen = (data[2] << 8) + data[3];
-		if (sublen > len)
+		if (sublen > len - 4)
 			break;
 
 		switch (subtype) {