diff options
| author | Sam Leffler <sam@FreeBSD.org> | 2006-07-16 16:02:17 +0000 |
|---|---|---|
| committer | Sam Leffler <sam@FreeBSD.org> | 2006-07-16 16:02:17 +0000 |
| commit | 70326a6eb6b8244bdb31bfddaeac88bad302d1a4 (patch) | |
| tree | 88ed8ddb92fd2e13a994fa82fa491c76e803483c /sys/net80211 | |
| parent | 970043d7cda0926f96cee2295cc5cf2b42b15680 (diff) | |
| download | src-70326a6eb6b8244bdb31bfddaeac88bad302d1a4.tar.gz src-70326a6eb6b8244bdb31bfddaeac88bad302d1a4.zip | |
tighten invariant on loops used to parse ie's; this ensures we never
touch data outside the packet (previously we might touch 1 byte); it
also has the happy side effect of working around broken orinoco/agere
firmware that sends malformed association response frames
Help by: Vladimir Egorin
Notes
Notes:
svn path=/head/; revision=160405
Diffstat (limited to 'sys/net80211')
| -rw-r--r-- | sys/net80211/ieee80211_input.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c index e6a9676fdfbe..c1c5d978338c 100644 --- a/sys/net80211/ieee80211_input.c +++ b/sys/net80211/ieee80211_input.c @@ -1818,7 +1818,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); scan.chan = scan.bchan; - while (frm < efrm) { + while (efrm - frm > 1) { IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); switch (*frm) { case IEEE80211_ELEMID_SSID: @@ -2065,7 +2065,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, * [tlv] extended supported rates */ ssid = rates = xrates = NULL; - while (frm < efrm) { + while (efrm - frm > 1) { IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); switch (*frm) { case IEEE80211_ELEMID_SSID: @@ -2242,7 +2242,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, if (reassoc) frm += 6; /* ignore current AP info */ ssid = rates = xrates = wpa = wme = NULL; - while (frm < efrm) { + while (efrm - frm > 1) { IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); switch (*frm) { case IEEE80211_ELEMID_SSID: @@ -2448,7 +2448,7 @@ ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, frm += 2; rates = xrates = wpa = wme = NULL; - while (frm < efrm) { + while (efrm - frm > 1) { IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]); switch (*frm) { case IEEE80211_ELEMID_RATES: |