Date: Thu, 8 Oct 2015 07:22:40 +0000 (UTC) From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r289012 - head/sys/dev/wpi Message-ID: <201510080722.t987MeYU051231@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: adrian Date: Thu Oct 8 07:22:40 2015 New Revision: 289012 URL: https://svnweb.freebsd.org/changeset/base/289012 Log: wpi(4): check size before transmitting frames In addition to https://bz-attachments.freebsd.org/attachment.cgi?id=156112; fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144987. Tested: * Tested with Intel 3945BG, STA mode Submitted by: <s3erios@gmail.com> Differential Revision: https://reviews.freebsd.org/D3762 Modified: head/sys/dev/wpi/if_wpi.c Modified: head/sys/dev/wpi/if_wpi.c ============================================================================== --- head/sys/dev/wpi/if_wpi.c Thu Oct 8 07:21:36 2015 (r289011) +++ head/sys/dev/wpi/if_wpi.c Thu Oct 8 07:22:40 2015 (r289012) @@ -2603,6 +2603,11 @@ wpi_cmd2(struct wpi_softc *sc, struct wp hdrlen = ieee80211_anyhdrsize(wh); totlen = buf->m->m_pkthdr.len; + if (__predict_false(totlen < sizeof(struct ieee80211_frame_min))) { + error = EINVAL; + goto fail; + } + if (hdrlen & 3) { /* First segment length must be a multiple of 4. */ pad = 4 - (hdrlen & 3);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201510080722.t987MeYU051231>