Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 6 Apr 2022 01:56:58 GMT
From:      Ed Maste <emaste@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 00cc1ce78da3 - releng/13.1 - net80211: validate Mesh ID length in ieee80211_parse_beacon
Message-ID:  <202204060156.2361uwMD038698@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch releng/13.1 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=00cc1ce78da3543ebfa7172323cdaa8ca290b55f

commit 00cc1ce78da3543ebfa7172323cdaa8ca290b55f
Author:     Bjoern A. Zeeb <bz@FreeBSD.org>
AuthorDate: 2022-04-05 22:51:19 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2022-04-06 01:56:33 +0000

    net80211: validate Mesh ID length in ieee80211_parse_beacon
    
    Reported by:    m00nbsd working with Trend Micro Zero Day Initiative
    
    (cherry picked from commit fb8c87b4f3bfdfac014f9d894fe75fbad0391b24)
    (cherry picked from commit 72617f9246e3a4be28eeafeae1bdd983143eef3e)
    
    Approved by:    so, re (implicit)
---
 sys/net80211/ieee80211_input.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c
index 516de781e23e..7406c92d6d0e 100644
--- a/sys/net80211/ieee80211_input.c
+++ b/sys/net80211/ieee80211_input.c
@@ -742,6 +742,12 @@ ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m,
 		IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),
 		    scan->status |= IEEE80211_BPARSE_CSA_INVALID);
 	}
+#ifdef IEEE80211_SUPPORT_MESH
+	if (scan->meshid != NULL) {
+		IEEE80211_VERIFY_ELEMENT(scan->meshid, IEEE80211_MESHID_LEN,
+		    scan->status |= IEEE80211_BPARSE_RATES_INVALID);
+	}
+#endif
 	/*
 	 * Process HT ie's.  This is complicated by our
 	 * accepting both the standard ie's and the pre-draft



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202204060156.2361uwMD038698>