d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net80211: discard an injected frame if it is smaller than header length.

Browse Source 
Do not try to pass such frames; a correct frame cannot be smaller than
(the corresponding) header size.
(for wpi(4) an additional check was added in r289012).

PR:		144987
This commit is contained in:
Andriy Voskoboinyk 2016-06-09 13:42:18 +00:00
parent bd2e8624e5
commit c8898568fd
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=301731
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/net80211/ieee80211_output.c
View File

@ -608,6 +608,8 @@ ieee80211_output(struct ifnet *ifp, struct mbuf *m,
if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
IEEE80211_FC0_VERSION_0)
senderr(EIO); /* XXX */
if (m->m_pkthdr.len < ieee80211_anyhdrsize(wh))
senderr(EIO); /* XXX */
/* locate destination node */
switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
@ -617,8 +619,6 @@ ieee80211_output(struct ifnet *ifp, struct mbuf *m,
break;
case IEEE80211_FC1_DIR_TODS:
case IEEE80211_FC1_DIR_DSTODS:
if (m->m_pkthdr.len < sizeof(struct ieee80211_frame))
senderr(EIO); /* XXX */
ni = ieee80211_find_txnode(vap, wh->i_addr3);
break;
default: