diff mbox series

[2/3] mac80211: parse only HE capability elements with valid size

Message ID 20220210201537.852e802ffb22.I645ac1e2dc0ace223ef3e551cd5a71c88bd55e04@changeid
State New
Headers show
Series HE capability element validation improvement | expand

Commit Message

Johannes Berg Feb. 10, 2022, 7:16 p.m. UTC 
From: Johannes Berg <johannes.berg@intel.com>

The code validates the HE capability element size later,
but slightly wrong, so use the new helper to do it right
and only accept it if it has a good size.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/mac80211/util.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index abc29df6834c..1a8e18794387 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -973,8 +973,10 @@  static void ieee80211_parse_extension_element(u32 *crc,
 		}
 		break;
 	case WLAN_EID_EXT_HE_CAPABILITY:
-		elems->he_cap = data;
-		elems->he_cap_len = len;
+		if (ieee80211_he_capa_size_ok(data, len)) {
+			elems->he_cap = data;
+			elems->he_cap_len = len;
+		}
 		break;
 	case WLAN_EID_EXT_HE_OPERATION:
 		if (len >= sizeof(*elems->he_operation) &&