diff options
| author | Adrian Chadd <adrian@FreeBSD.org> | 2015-10-08 07:22:40 +0000 |
|---|---|---|
| committer | Adrian Chadd <adrian@FreeBSD.org> | 2015-10-08 07:22:40 +0000 |
| commit | fbcf1662deedc05501655a20b8e762868b742653 (patch) | |
| tree | 97bd7af98783a800f465a74ed0b00a9f02fbbb55 /sys/dev/wpi | |
| parent | 4c09e592e611c3179bc8fb1d0dcaf4c52b79631b (diff) | |
| download | src-fbcf1662deedc05501655a20b8e762868b742653.tar.gz src-fbcf1662deedc05501655a20b8e762868b742653.zip | |
wpi(4): check size before transmitting frames
In addition to https://bz-attachments.freebsd.org/attachment.cgi?id=156112;
fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144987.
Tested:
* Tested with Intel 3945BG, STA mode
Submitted by: <s3erios@gmail.com>
Differential Revision: https://reviews.freebsd.org/D3762
Notes
Notes:
svn path=/head/; revision=289012
Diffstat (limited to 'sys/dev/wpi')
| -rw-r--r-- | sys/dev/wpi/if_wpi.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/sys/dev/wpi/if_wpi.c b/sys/dev/wpi/if_wpi.c index 9df98fa81ecc..a36c2ed404e2 100644 --- a/sys/dev/wpi/if_wpi.c +++ b/sys/dev/wpi/if_wpi.c @@ -2603,6 +2603,11 @@ wpi_cmd2(struct wpi_softc *sc, struct wpi_buf *buf) hdrlen = ieee80211_anyhdrsize(wh); totlen = buf->m->m_pkthdr.len; + if (__predict_false(totlen < sizeof(struct ieee80211_frame_min))) { + error = EINVAL; + goto fail; + } + if (hdrlen & 3) { /* First segment length must be a multiple of 4. */ pad = 4 - (hdrlen & 3); |