From 141aa3b93af46d92202ed445b3367fdd8b1c2d18 Mon Sep 17 00:00:00 2001
From: Kevin Lo <kevlo@FreeBSD.org>
Date: Tue, 9 Sep 2014 05:21:31 +0000
Subject: [PATCH] Drop frames that have larger than MCLBYTES.

---
 sys/dev/usb/wlan/if_urtwn.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/dev/usb/wlan/if_urtwn.c b/sys/dev/usb/wlan/if_urtwn.c
index 1f1446cdfcd..6fbb4d2757e 100644
--- a/sys/dev/usb/wlan/if_urtwn.c
+++ b/sys/dev/usb/wlan/if_urtwn.c
@@ -660,6 +660,10 @@ urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
 		ifp->if_ierrors++;
 		return (NULL);
 	}
+	if (pktlen < sizeof(*wh) || pktlen > MCLBYTES) {
+		ifp->if_ierrors++;
+		return (NULL);
+	}
 
 	rate = MS(rxdw3, R92C_RXDW3_RATE);
 	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;