mac80211: validate TIM IE length

The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dc60804d6dd0309aa376e000203bfe74e46d55d1..1619e0cd26e2d9b36d443692fe071be86d041ffe 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -441,6 +441,9 @@ static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid)
        u8 index, indexn1, indexn2;
        struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;
 
+       if (unlikely(!tim || elems->tim_len < 4))
+               return false;
+
        aid &= 0x3fff;
        index = aid / 8;
        mask  = 1 << (aid & 7);