From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 16 Dec 2013 11:04:36 +0000 (+0100)
Subject: radiotap: fix bitmap-end-finding buffer overrun
X-Git-Tag: v3.13-rc7~13^2~19^2^2~4^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bd02cd2549cfcdfc57cb5ce57ffc3feb94f70575;p=pandora-kernel.git

radiotap: fix bitmap-end-finding buffer overrun

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---

Reading git-diff-tree failed