d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use m_catpkt(9) to avoid a possible use-after-free in ieee80211_defrag().

Browse Source 
m is not guaranteed to be valid after m_cat() returns. The effects of this
are most noticeable when INVARIANTS is enabled, since m's header length
field is given a value of 0xdeadc0de by the trash dtor.

Reviewed by:	glebius
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D5497
This commit is contained in:
Mark Johnston 2016-03-02 05:01:58 +00:00
parent a3f6b02969
commit f6ed0a3918
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/net80211/ieee80211_input.c
View File

@ -249,9 +249,7 @@ ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace)
mfrag = m;
} else { /* concatenate */
m_adj(m, hdrspace); /* strip header */
m_cat(mfrag, m);
/* NB: m_cat doesn't update the packet header */
mfrag->m_pkthdr.len += m->m_pkthdr.len;
m_catpkt(mfrag, m);
/* track last seqnum and fragno */
lwh = mtod(mfrag, struct ieee80211_frame *);
*(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;