Dan Carpenter 41eedf39df rndis_wlan: integer overflows in rndis_wlan_do_link_up_work() ...

If "offset" is negative then we can get past this check:
	if (offset > CONTROL_BUFFER_SIZE)
Or if we pick a very high "req_ie_len" then we can get around the check:
	if (offset + req_ie_len > CONTROL_BUFFER_SIZE)

I made "resp_ie_len" and "req_ie_len" unsigned.  I don't know if it was
intentional that they were signed in the original.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

2012-03-05 15:23:15 -05:00

..

appletalk

…

arcnet

net: Revert ARCNET and PHYLIB to tristate options

2011-11-26 14:36:49 -05:00

bonding

bonding: fix enslaving in alb mode when link down

2012-01-18 20:59:53 -05:00

caif

module_param: make bool parameters really bool (net & drivers/net)

2011-12-19 22:27:29 -05:00

can

Merge tag 'clk' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

2012-01-09 14:44:15 -08:00

cris

…

dsa

drivers/net: dsa/mv88e6xxx.c files need linux/module.h

2012-01-24 15:44:50 -05:00

ethernet

stmmac: added PCI identifiers

2012-01-24 15:44:20 -05:00

fddi

skfp: Fix SysKonnect FDDI driver compile issues

2011-08-27 00:58:23 -07:00

hamradio

…

hippi

net: drivers/net/hippi/Kconfig should be sourced

2011-11-09 15:55:06 -05:00

hyperv

net/hyperv: fix possible memory leak in do_set_multicast()

2012-01-24 15:47:47 -05:00

irda

Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus

2012-01-14 13:05:21 -08:00

phy

kernel-doc: fix new warning in net/phy/mdio_bus.c

2012-01-22 15:08:45 -05:00

plip

plip: Move the PLIP driver

2011-08-27 00:58:33 -07:00

ppp

pptp: Accept packet with seq zero

2012-01-12 20:05:28 -08:00

slip

slip: Move the SLIP drivers

2011-08-27 00:58:36 -07:00

team

team: send only changed options/ports via netlink

2012-01-24 15:51:00 -05:00

tokenring

drivers/net: Kconfig & Makefile cleanup

2011-08-27 00:58:49 -07:00

usb

asix: fix setting custom MAC address on Asix 88178 devices

2012-01-10 14:59:48 -08:00

vmxnet3

vmxnet3" make ethtool ops const

2012-01-05 13:23:00 -05:00

wan

module_param: make bool parameters really bool (net & drivers/net)

2011-12-19 22:27:29 -05:00

wimax

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2012-01-08 13:21:22 -08:00

wireless

rndis_wlan: integer overflows in rndis_wlan_do_link_up_work()

2012-03-05 15:23:15 -05:00

xen-netback

Merge branch 'stable/for-linus-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2012-01-10 10:09:59 -08:00

dummy.c

net: remove NETIF_F_NO_CSUM feature bit

2011-11-16 17:43:12 -05:00

eql.c

…

ifb.c

net: remove NETIF_F_NO_CSUM feature bit

2011-11-16 17:43:12 -05:00

Kconfig

Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2012-01-09 12:18:17 -08:00

LICENSE.SRC

…

loopback.c

net: remove NETIF_F_NO_CSUM feature bit

2011-11-16 17:43:12 -05:00

macvlan.c

macvlan: fix a possible use after free

2012-01-23 13:56:18 -05:00

macvtap.c

macvtap: Fix macvtap_get_queue to use rxhash first

2011-12-20 13:45:55 -05:00

Makefile

Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2012-01-09 12:18:17 -08:00

mdio.c

…

mii.c

net: Change mii to ethtool advertisement function names

2011-11-21 15:27:19 -05:00

netconsole.c

netconsole: enable netconsole can make net_device refcnt incorrent

2011-10-18 23:55:29 -04:00

rionet.c

drivers/net/rionet.c: fix ethernet address macros for LE platforms

2011-11-02 16:07:01 -07:00

sb1000.c

…

Space.c

…

sungem_phy.c

…

tun.c

Sweep away N/A fw_version dustbunnies from the .get_drvinfo routine of a number of drivers

2011-11-22 16:43:32 -05:00

veth.c

Sweep away N/A fw_version dustbunnies from the .get_drvinfo routine of a number of drivers

2011-11-22 16:43:32 -05:00

virtio_net.c

virtio: net: Add freeze, restore handlers to support S4

2012-01-12 15:44:46 +10:30

xen-netfront.c

xen-netfront: correct MAX_TX_TARGET calculation.

2012-01-26 13:48:35 -05:00