tree d43aaa563d7e977e8b8122777baef54930528049
parent 4c4d684a55fc01dac6bee696efc56b96d0e6c03a
author Johannes Berg <johannes.berg@intel.com> 1387191876 +0100
committer Johannes Berg <johannes.berg@intel.com> 1387192003 +0100

radiotap: fix bitmap-end-finding buffer overrun

Evan Huus found (by fuzzing in wireshark) that the radiotap
iterator code can access beyond the length of the buffer if
the first bitmap claims an extension but then there's no
data at all. Fix this.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>