aircrack-ng/aircrack-ng — pull request #16 by NickSampanis (2014-10-02 13:24:13+00:00)
Title: net_get assigns negative integer to len argument

net_get reads nh structure. which contains a length field. The length field is assigned to len argument and gets returned by reference. A segmentation fault can occur if a malicious server sends back a negative length. As a result net_get will return with a negative length which may be used erroneously as valid. As an example the function net_get_nopacket:
uses net_get( pn->pn_s, buf, &l);
memcpy(arg, buf, l);