iwinfo: Fix incorrect buffer allocation in nl80211_get_ifcomb_cb()
authorAndrew McDonnell <bugs@andrewmcdonnell.net>
Thu, 11 Dec 2014 13:47:45 +0000 (00:17 +1030)
committerJohn Crispin <blogic@openwrt.org>
Fri, 12 Dec 2014 14:36:41 +0000 (15:36 +0100)
This fixes a buffer overwrite, I found it when building with SSP enabled

iwinfo_nl80211.c

index 2731b2bbef108520ebf00de66f098d2ed41ae9f0..be58c56118c66bbfac82949711fdff79305e6cd3 100644 (file)
@@ -2446,15 +2446,15 @@ static int nl80211_get_ifcomb_cb(struct nl_msg *msg, void *arg)
                        [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
                        [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
                };
-               struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
+               struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB+1];
                static struct nla_policy iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
                        [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
                        [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
                };
-               struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
+               struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT+1];
                struct nlattr *limit;
 
-               nla_parse_nested(tb_comb, NL80211_BAND_ATTR_MAX, comb, iface_combination_policy);
+               nla_parse_nested(tb_comb, NUM_NL80211_IFACE_COMB, comb, iface_combination_policy);
 
                if (!tb_comb[NL80211_IFACE_COMB_LIMITS])
                        continue;