From owner-freebsd-bugs  Fri Jun 28 14:10:20 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B681237B400
	for <freebsd-bugs@hub.freebsd.org>; Fri, 28 Jun 2002 14:10:08 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AFD9843E1A
	for <freebsd-bugs@hub.freebsd.org>; Fri, 28 Jun 2002 14:10:03 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g5SLA3JU019564
	for <freebsd-bugs@freefall.freebsd.org>; Fri, 28 Jun 2002 14:10:03 -0700 (PDT)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g5SLA3XS019563;
	Fri, 28 Jun 2002 14:10:03 -0700 (PDT)
Date: Fri, 28 Jun 2002 14:10:03 -0700 (PDT)
Message-Id: <200206282110.g5SLA3XS019563@freefall.freebsd.org>
To: freebsd-bugs@FreeBSD.org
Cc: 
From: elias@kjell.utb.falun.se (elias)
Subject: Re: kern/39960: wi driver can cause system crash when trying to handle negative value for WI_RID_TX_CRYPT_KEY
Reply-To: elias@kjell.utb.falun.se (elias)
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org

The following reply was made to PR kern/39960; it has been noted by GNATS.

From: elias@kjell.utb.falun.se (elias)
To: freebsd-gnats-submit@FreeBSD.org
Cc:  
Subject: Re: kern/39960: wi driver can cause system crash when trying to handle negative value for WI_RID_TX_CRYPT_KEY
Date: Fri, 28 Jun 2002 23:01:18 +0200 (CEST)

 Here's the patch. (somehow it was left out of the original post)
 
 ----cut------------
 *** if_wi.c.old Fri Jun 28 15:42:24 2002
 --- if_wi.c     Fri Jun 28 15:45:20 2002
 ***************
 *** 1151,1156 ****
 --- 1151,1159 ----
                         ltv = &p2ltv;
                         break;
                 case WI_RID_TX_CRYPT_KEY:
 +                       /* negative can values result in kernel crash */
 +                       if( ltv->wi_val < 0 )
 +                               return 0;
                         p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY;
                         p2ltv.wi_len = 2;
                         p2ltv.wi_val = ltv->wi_val;
 ----cut------------

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message