mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-03 12:35:02 +00:00
Code Issues Releases Activity

wpi(4): check size before transmitting frames

Browse Source 
In addition to https://bz-attachments.freebsd.org/attachment.cgi?id=156112;
fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144987.

Tested:

* Tested with Intel 3945BG, STA mode

Submitted by:	<s3erios@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D3762
This commit is contained in:
Adrian Chadd 2015-10-08 07:22:40 +00:00
parent 4c09e592e6
commit fbcf1662de
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=289012
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/dev/wpi/if_wpi.c
View File

@ -2603,6 +2603,11 @@ wpi_cmd2(struct wpi_softc *sc, struct wpi_buf *buf)
hdrlen = ieee80211_anyhdrsize(wh);
totlen = buf->m->m_pkthdr.len;
if (__predict_false(totlen < sizeof(struct ieee80211_frame_min))) {
error = EINVAL;
goto fail;
}
if (hdrlen & 3) {
/* First segment length must be a multiple of 4. */
pad = 4 - (hdrlen & 3);