← Back to branch summary

~okay19/ubuntu/wily/wpa/fix-bug-1405452

« back to all changes in this revision

Viewing changes to src/ap/wmm.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2015-06-15 10:21:54 UTC
  • Revision ID: package-import@ubuntu.com-20150615102154-ddefaqfiv96swpkb
Tags: 2.1-0ubuntu8
* SECURITY UPDATE: memcpy overflow in P2P functionality
  - debian/patches/CVE-2015-1863.patch: validate SID element length in
    src/p2p/p2p.c.
  - CVE-2015-1863
* SECURITY UPDATE: denial of service via WPS UPnP
  - debian/patches/CVE-2015-4141.patch: check chunk size in
    src/wps/httpread.c.
  - CVE-2015-4141
* SECURITY UPDATE: denial of service via AP mode WMM Action frame
  - debian/patches/CVE-2015-4142.patch: check length in src/ap/wmm.c.
  - CVE-2015-4142
* SECURITY UPDATE: denial of service via EAP-pwd
  - debian/patches/CVE-2015-4143-4146.patch: check lengths in
    src/eap_peer/eap_pwd.c, src/eap_server/eap_server_pwd.c.
  - CVE-2015-4143
  - CVE-2015-4144
  - CVE-2015-4145
  - CVE-2015-4146

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/ap/wmm.c
274
274
                return;
275
275
        }
276
276
 
 
277
        if (left < 0)
 
278
                return; /* not a valid WMM Action frame */
 
279
 
277
280
        /* extract the tspec info element */
278
281
        if (ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed) {
279
282
                hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,