The branch main has been updated by emaste:
URL:
https://cgit.FreeBSD.org/src/commit/?id=fb8c87b4f3bfdfac014f9d894fe75fbad0391b24
commit fb8c87b4f3bfdfac014f9d894fe75fbad0391b24
Author: Bjoern A. Zeeb <b...@freebsd.org>
AuthorDate: 2022-04-05 22:58:28 +0000
Commit: Ed Maste <ema...@freebsd.org>
CommitDate: 2022-04-05 22:58:28 +0000
net80211: validate Mesh ID length in ieee80211_parse_beacon
Reported by: m00nbsd working with Trend Micro Zero Day Initiative
---
sys/net80211/ieee80211_input.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c
index 516de781e23e..7406c92d6d0e 100644
--- a/sys/net80211/ieee80211_input.c
+++ b/sys/net80211/ieee80211_input.c
@@ -742,6 +742,12 @@ ieee80211_parse_beacon(struct ieee80211_node *ni, struct
mbuf *m,
IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),
scan->status |= IEEE80211_BPARSE_CSA_INVALID);
}
+#ifdef IEEE80211_SUPPORT_MESH
+ if (scan->meshid != NULL) {
+ IEEE80211_VERIFY_ELEMENT(scan->meshid, IEEE80211_MESHID_LEN,
+ scan->status |= IEEE80211_BPARSE_RATES_INVALID);
+ }
+#endif
/*
* Process HT ie's. This is complicated by our
* accepting both the standard ie's and the pre-draft
