Date: Tue, 9 Sep 2014 05:21:32 +0000 (UTC) From: Kevin Lo <kevlo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r271303 - head/sys/dev/usb/wlan Message-ID: <201409090521.s895LWgQ037335@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kevlo Date: Tue Sep 9 05:21:31 2014 New Revision: 271303 URL: http://svnweb.freebsd.org/changeset/base/271303 Log: Drop frames that have larger than MCLBYTES. Modified: head/sys/dev/usb/wlan/if_urtwn.c Modified: head/sys/dev/usb/wlan/if_urtwn.c ============================================================================== --- head/sys/dev/usb/wlan/if_urtwn.c Tue Sep 9 04:20:53 2014 (r271302) +++ head/sys/dev/usb/wlan/if_urtwn.c Tue Sep 9 05:21:31 2014 (r271303) @@ -660,6 +660,10 @@ urtwn_rx_frame(struct urtwn_softc *sc, u ifp->if_ierrors++; return (NULL); } + if (pktlen < sizeof(*wh) || pktlen > MCLBYTES) { + ifp->if_ierrors++; + return (NULL); + } rate = MS(rxdw3, R92C_RXDW3_RATE); infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201409090521.s895LWgQ037335>