Date: Mon, 2 Dec 2013 03:42:40 +0000 (UTC) From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r258824 - head/sys/dev/iwn Message-ID: <201312020342.rB23geHH092674@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: adrian Date: Mon Dec 2 03:42:39 2013 New Revision: 258824 URL: http://svnweb.freebsd.org/changeset/base/258824 Log: Add some sanity checks to the TLV fetch. Obtained from: Linux iwlwifi Modified: head/sys/dev/iwn/if_iwn.c Modified: head/sys/dev/iwn/if_iwn.c ============================================================================== --- head/sys/dev/iwn/if_iwn.c Mon Dec 2 03:40:51 2013 (r258823) +++ head/sys/dev/iwn/if_iwn.c Mon Dec 2 03:42:39 2013 (r258824) @@ -7506,8 +7506,16 @@ iwn_read_firmware_tlv(struct iwn_softc * DPRINTF(sc, IWN_DEBUG_RESET, "PAN Support found: %d\n", 1); break; - case IWN_FW_TLV_FLAGS : - sc->tlv_feature_flags = htole32(*ptr); + case IWN_FW_TLV_FLAGS: + if (len < sizeof(uint32_t)) + break; + if (len % sizeof(uint32_t)) + break; + sc->tlv_feature_flags = le32toh(*ptr); + DPRINTF(sc, IWN_DEBUG_RESET, + "%s: feature: 0x%08x\n", + __func__, + sc->tlv_feature_flags); break; case IWN_FW_TLV_PBREQ_MAXLEN: case IWN_FW_TLV_RUNT_EVTLOG_PTR:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201312020342.rB23geHH092674>