Johannes Berg 48735d8d8b libertas: fix buffer overrun
If somebody sends an invalid beacon/probe response, that can trash the
whole BSS descriptor. The descriptor is, luckily, large enough so that
it cannot scribble past the end of it; it's well above 400 bytes long.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Cc: stable@kernel.org [2.6.24-2.6.27, bug present in some form since driver was added (2.6.22)]
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2008-10-29 17:54:35 -04:00
..
2008-10-24 08:22:38 -07:00
2008-10-21 07:48:21 -04:00
2008-10-20 08:52:40 -07:00
2008-10-22 01:19:39 +02:00
2008-10-26 09:35:05 -07:00
2008-10-25 04:07:14 -04:00
2008-10-21 07:48:33 -04:00
2008-10-23 00:43:47 -04:00
2008-10-21 07:48:37 -04:00
2008-10-29 17:54:35 -04:00
2008-10-16 11:21:30 -07:00
2008-10-21 15:49:55 +11:00
2008-10-25 04:07:14 -04:00
2008-10-23 00:11:07 -04:00
2008-10-23 09:35:18 -07:00
2008-10-20 08:52:36 -07:00
2008-10-23 09:19:47 -07:00
2008-10-22 22:55:20 -07:00