diff options
| author | Joshua Oreman | 2010-07-30 05:13:31 +0200 |
|---|---|---|
| committer | Michael Brown | 2010-08-01 18:29:57 +0200 |
| commit | 73aea88a62ac46464a2eec7a94a6350ae7a36bbf (patch) | |
| tree | 9b52f7595b8f4e2f0a07e34c0fa7b067fc36916f /src/net/80211 | |
| parent | [802.11] Use correct name for sec80211_detect() (diff) | |
| download | ipxe-73aea88a62ac46464a2eec7a94a6350ae7a36bbf.tar.gz ipxe-73aea88a62ac46464a2eec7a94a6350ae7a36bbf.tar.xz ipxe-73aea88a62ac46464a2eec7a94a6350ae7a36bbf.zip | |
[802.11] Fix a use-after-free
When we received an encrypted packet, after replacing it with its
decrypted version and freeing the encrypted original, we would
continue to look at the header of the now-freed original packet. Fix
by moving the header pointer to point at the decrypted packet instead.
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/net/80211')
| -rw-r--r-- | src/net/80211/net80211.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/net/80211/net80211.c b/src/net/80211/net80211.c index 7b391145..ffa5c911 100644 --- a/src/net/80211/net80211.c +++ b/src/net/80211/net80211.c @@ -2720,6 +2720,7 @@ void net80211_rx ( struct net80211_device *dev, struct io_buffer *iob, } free_iob ( iob ); iob = niob; + hdr = iob->data; } dev->last_signal = signal; |