Author: adrian Date: Thu Oct 8 07:22:40 2015 New Revision: 289012 URL: https://svnweb.freebsd.org/changeset/base/289012
Log: wpi(4): check size before transmitting frames In addition to https://bz-attachments.freebsd.org/attachment.cgi?id=156112; fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144987. Tested: * Tested with Intel 3945BG, STA mode Submitted by: <s3er...@gmail.com> Differential Revision: https://reviews.freebsd.org/D3762 Modified: head/sys/dev/wpi/if_wpi.c Modified: head/sys/dev/wpi/if_wpi.c ============================================================================== --- head/sys/dev/wpi/if_wpi.c Thu Oct 8 07:21:36 2015 (r289011) +++ head/sys/dev/wpi/if_wpi.c Thu Oct 8 07:22:40 2015 (r289012) @@ -2603,6 +2603,11 @@ wpi_cmd2(struct wpi_softc *sc, struct wp hdrlen = ieee80211_anyhdrsize(wh); totlen = buf->m->m_pkthdr.len; + if (__predict_false(totlen < sizeof(struct ieee80211_frame_min))) { + error = EINVAL; + goto fail; + } + if (hdrlen & 3) { /* First segment length must be a multiple of 4. */ pad = 4 - (hdrlen & 3); _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
