Commit 01e1f045 authored by Daniel Drake's avatar Daniel Drake Committed by John W. Linville

ieee80211: fix unaligned access in ieee80211_copy_snap

There is no guarantee that data+SNAP_SIZE will reside on an even numbered
address, so doing a 16 bit read will cause an unaligned access in some
situations. Based on a patch from Jun Sun.
Signed-off-by: default avatarDaniel Drake <dsd@gentoo.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent a10605e5
...@@ -144,7 +144,8 @@ static int ieee80211_copy_snap(u8 * data, u16 h_proto) ...@@ -144,7 +144,8 @@ static int ieee80211_copy_snap(u8 * data, u16 h_proto)
snap->oui[1] = oui[1]; snap->oui[1] = oui[1];
snap->oui[2] = oui[2]; snap->oui[2] = oui[2];
*(u16 *) (data + SNAP_SIZE) = htons(h_proto); h_proto = htons(h_proto);
memcpy(data + SNAP_SIZE, &h_proto, sizeof(u16));
return SNAP_SIZE + sizeof(u16); return SNAP_SIZE + sizeof(u16);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment