d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ath: fix possible memory disclosures in ioctl handlers

Browse Source 
Apply the fix from r327499 to additional ioctl handlers.

Reported by:	Ilja van Sprundel <ivansprundel@ioactive.com>
MFC after:	1 week
MFC with:	r327499
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
emaste 2018-01-02 19:34:23 +00:00
parent 9e20f9abb6
commit 60d6b01bb9
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/dev/ath/if_ath_lna_div.c
View File

@ -189,7 +189,7 @@ ath_lna_div_ioctl(struct ath_softc *sc, struct ath_diag *ad)
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
outdata = malloc(outsize, M_TEMP, M_NOWAIT);
outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@ -198,6 +198,7 @@ ath_lna_div_ioctl(struct ath_softc *sc, struct ath_diag *ad)
switch (id) {
default:
error = EINVAL;
goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;

3
sys/dev/ath/if_ath_spectral.c
View File

@ -219,7 +219,7 @@ ath_ioctl_spectral(struct ath_softc *sc, struct ath_diag *ad)
* pointer for us to use below in reclaiming the buffer;
* may want to be more defensive.
*/
outdata = malloc(outsize, M_TEMP, M_NOWAIT);
outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) {
error = ENOMEM;
goto bad;
@ -282,6 +282,7 @@ ath_ioctl_spectral(struct ath_softc *sc, struct ath_diag *ad)
break;
default:
error = EINVAL;
goto bad;
}
if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize;