mac80211: add missing length check for confirm frames

[linux-2.6-block.git] / net / mac80211 / mesh_plink.c

diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index f17127e754c9410d7cd3df3a8c11f25e775c0470..3b59099413fb1770e2ee2228065899bc5f9eb302 100644 (file)
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                                                WLAN_SP_MESH_PEERING_CONFIRM) {
                baseaddr += 4;
                baselen += 4;
+
+               if (baselen > len)
+                       return;
        }
        ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
        mesh_process_plink_frame(sdata, mgmt, &elems);