On Tue, 2015-07-14 at 08:31 -0400, Bob Copeland wrote: > Although mesh_rx_plink_frame() already checks that frames have enough > bytes for the action code plus another two bytes for > capability/reason > code, it doesn't take into account that confirm frames also have an > additional two-byte aid. As a result, a corrupt frame could cause a > subsequent subtraction to wrap around to ill effect. Add another > check for this case. > Also applied. johannes -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
