KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

add an update for the not-entirely-correct security fix of madwifi (see [5720], madwifi changeset 1847)

Browse source 
SVN-Revision: 5726
This commit is contained in:
Felix Fietkau 2006-12-08 16:48:43 +00:00
parent 3264c50c3a
commit 4bead05b28
1 changed files with 27 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
package/madwifi/patches/105-security_patch_fix.patch Normal file
View file

@ -0,0 +1,27 @@
The fix for CVE-2006-6332 in r1842 was not entirely correct. In
encode_ie() the bound check did not consider that each byte from
the IE causes two bytes to be written into buffer. That could
lead to a kernel oops, but does not allow code injection. This is
now fixed.
Due to the type of this problem it does not trigger another
urgent security bugfix release. v0.9.3 is at the door anyway.
Reported-by: Joachim Gleisner <jg@suse.de>
Index: trunk/net80211/ieee80211_wireless.c
===================================================================
--- trunk/net80211/ieee80211_wireless.c (revision 1846)
+++ trunk/net80211/ieee80211_wireless.c (revision 1847)
@@ -1566,8 +1566,8 @@
bufsize -= leader_len;
p += leader_len;
- if (bufsize < ielen)
- return 0;
- for (i = 0; i < ielen && bufsize > 2; i++)
+ for (i = 0; i < ielen && bufsize > 2; i++) {
p += sprintf(p, "%02x", ie[i]);
+ bufsize -= 2;
+ }
return (i == ielen ? p - (u_int8_t *)buf : 0);
}