diff -urNp aircrack-ng-0.7.org/src/airodump-ng.c aircrack-ng-0.7/src/airodump-ng.c --- aircrack-ng-0.7.org/src/airodump-ng.c 2007-01-07 18:11:06.000000000 +0200 +++ aircrack-ng-0.7/src/airodump-ng.c 2007-04-13 19:41:34.000000000 +0300 @@ -261,6 +261,8 @@ int check_shared_key(unsigned char *h802 char prga[512]; unsigned int long crc; + if((unsigned)caplen > sizeof(h80211)) return 1; + if( time(NULL) - G.sk_start > 5) { /* timeout(5sec) - remove all packets, restart timer */ @@ -323,6 +325,8 @@ int check_shared_key(unsigned char *h802 textlen = G.sk_len; + if((unsigned)textlen > sizeof(text)) return 1; + memcpy(text, G.sharedkey[0]+24, textlen); @@ -970,6 +974,7 @@ skip_station: { // n = ( p[1] > 32 ) ? 32 : p[1]; n = p[1]; + n &= 0xff; for( i = 0; i < n; i++ ) if( p[2 + i] > 0 && p[2 + i] < ' ' ) @@ -1029,6 +1034,7 @@ skip_probe: // n = ( p[1] > 32 ) ? 32 : p[1]; n = p[1]; + n &= 0xff; memset( ap_cur->essid, 0, 256 ); memcpy( ap_cur->essid, p + 2, n );