From owner-freebsd-wireless@freebsd.org  Mon May 16 23:44:11 2016
Return-Path: <owner-freebsd-wireless@freebsd.org>
Delivered-To: freebsd-wireless@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3F354B3E976
 for <freebsd-wireless@mailman.ysv.freebsd.org>;
 Mon, 16 May 2016 23:44:11 +0000 (UTC)
 (envelope-from andriyvos@gmail.com)
Received: from mail-lf0-f52.google.com (mail-lf0-f52.google.com
 [209.85.215.52])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id C768D1888;
 Mon, 16 May 2016 23:44:10 +0000 (UTC)
 (envelope-from andriyvos@gmail.com)
Received: by mail-lf0-f52.google.com with SMTP id y84so123501773lfc.0;
 Mon, 16 May 2016 16:44:10 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20130820;
 h=x-gm-message-state:to:cc:subject:references:date:mime-version
 :content-transfer-encoding:from:message-id:in-reply-to:user-agent;
 bh=ZCGRUDGKytY3rAEDr1hpfbKbwkFJxx+emaUXbqV4BvU=;
 b=ZvoHz9jfO3zLF+xoRvFUM+mNRoLuBXpXpxb/Z3rjxvB8zsAGyb305gxPNcEHifRjmu
 n2H58s0sD4/L9r4EZ6fjuhqPceqergL78hJ38cJfH3WdcFXP3BNewZEPKRHHO6El42DP
 c8SzARD8iv+t86uDGkbqQPD15sk5gvVaMevAENaTpM6hIEMvh2j2urq5Dm16txmOUKlf
 aJkc+3MrGislTjVYS/IMXdtQDCgb31c281LCwXy0MnOkvuDRXIeKL/5WsQz9HEtigkLu
 MVdU8rorMqrfZM+yLQg+MbNstvguK8DI7FZminH9FBncun+jejyXn1hFd5k1/G00q4Sg
 mCkQ==
X-Gm-Message-State: AOPr4FVtG+gboEFMlEbRwRqqZe6Ui1c3ZfWKIX6ANIYsc1f+hrDXOHpQtYkhRu58Kf8aKg==
X-Received: by 10.25.196.9 with SMTP id u9mr12646546lff.129.1463436363097;
 Mon, 16 May 2016 15:06:03 -0700 (PDT)
Received: from localhost (host-176-37-109-22.la.net.ua. [176.37.109.22])
 by smtp.gmail.com with ESMTPSA id uc8sm5447587lbb.30.2016.05.16.15.06.01
 (version=TLS1 cipher=AES128-SHA bits=128/128);
 Mon, 16 May 2016 15:06:02 -0700 (PDT)
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: "Adrian Chadd" <adrian.chadd@gmail.com>
Cc: "Don Lewis" <truckman@freebsd.org>, "freebsd-wireless@freebsd.org"
 <freebsd-wireless@freebsd.org>
Subject: Re: minor array overflow in ifconfig set80211chanlist()
References: <201605162142.u4GLgs8d072880@gw.catspoiler.org>
 <op.yhkssoeniew4ia@localhost>
 <CAJ-VmokTDO9=ZX5rGT1ZtW2aBEvzB_EVpEZvL7crs-KrQmqVMA@mail.gmail.com>
Date: Tue, 17 May 2016 01:05:57 +0300
MIME-Version: 1.0
Content-Transfer-Encoding: Quoted-Printable
From: "Andriy Voskoboinyk" <avos@freebsd.org>
Message-ID: <op.yhksz7c44dikkl@localhost>
In-Reply-To: <CAJ-VmokTDO9=ZX5rGT1ZtW2aBEvzB_EVpEZvL7crs-KrQmqVMA@mail.gmail.com>
User-Agent: Opera Mail/12.16 (FreeBSD)
X-BeenThere: freebsd-wireless@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Discussions of 802.11 stack,
 tools device driver development." <freebsd-wireless.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-wireless/>
List-Post: <mailto:freebsd-wireless@freebsd.org>
List-Help: <mailto:freebsd-wireless-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 16 May 2016 23:44:11 -0000

Tue, 17 May 2016 01:03:03 +0300 =D0=B1=D1=83=D0=BB=D0=BE =D0=BD=D0=B0=D0=
=BF=D0=B8=D1=81=D0=B0=D0=BD=D0=BE Adrian Chadd  =

<adrian.chadd@gmail.com>:

> Heh, god, it's used for both maximum ieee channel number /and/ the
> array size? we should eventually fix that; 11ac channels will likely
> overflow all of the above. :(

No (yes) :)
I mean ic->ic_nchans and nitems(ic->ic_channels)
... but you are right: ic_ieee is uint8_t, so it's limited by this numbe=
r  =

too.

>
>
>
> -a
> _______________________________________________
> freebsd-wireless@freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-wireless
> To unsubscribe, send any mail to  =

> "freebsd-wireless-unsubscribe@freebsd.org"