d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wpi(4): check size before transmitting frames

Browse Source 
In addition to https://bz-attachments.freebsd.org/attachment.cgi?id=156112;
fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144987.

Tested:

* Tested with Intel 3945BG, STA mode

Submitted by:	<s3erios@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D3762
This commit is contained in:
adrian 2015-10-08 07:22:40 +00:00
parent d955774944
commit 2d0e301063
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/dev/wpi/if_wpi.c
View File

@ -2603,6 +2603,11 @@ wpi_cmd2(struct wpi_softc *sc, struct wpi_buf *buf)
hdrlen = ieee80211_anyhdrsize(wh);
totlen = buf->m->m_pkthdr.len;
if (__predict_false(totlen < sizeof(struct ieee80211_frame_min))) {
error = EINVAL;
goto fail;
}
if (hdrlen & 3) {
/* First segment length must be a multiple of 4. */
pad = 4 - (hdrlen & 3);