| commit | 93db1d9e6c96050b74bb2793de8db00cd0afe6ab | [log] [tgz] |
|---|---|---|
| author | Johannes Berg <johannes.berg@intel.com> | Wed Sep 14 09:23:51 2016 +0200 |
| committer | Johannes Berg <johannes.berg@intel.com> | Thu Sep 15 16:46:16 2016 +0200 |
| tree | 83a76bdd049de1a15b56a6d9cd4243486d1d5a0e | |
| parent | f1c1f17ac52d22227c0074b3d661d7ed692b707a [diff] |
mac80211: fix possible out-of-bounds access In the unlikely situation that the supplicant has negotiated admission for the background AC (which it has no reason to as it's not supposed to be requiring admission control to start with, and we'd ignore such a requirement anyway), the loop here may terminate with non_acm_ac == 4, which leads to an array overrun. Check this explicitly just for completeness. Signed-off-by: Johannes Berg <johannes.berg@intel.com>