Page MenuHomeFreeBSD
Files F109621160

D36245.diff
No OneTemporary
Actions

D36245.diff
View Options

diff --git a/sys/net80211/ieee80211_node.c b/sys/net80211/ieee80211_node.c
--- a/sys/net80211/ieee80211_node.c
+++ b/sys/net80211/ieee80211_node.c
@@ -1137,6 +1137,14 @@
ie = ies->data;
ielen = ies->len;
while (ielen > 1) {
+ /* Make sure the given IE length fits into the total length. */
+ if ((2 + ie[1]) > ielen) {
+ printf("%s: malformed IEs! ies %p { data %p len %d }: "
+ "ie %u len 2+%u > total len left %d\n",
+ __func__, ies, ies->data, ies->len,
+ ie[0], ie[1], ielen);
+ return;
+ }
switch (ie[0]) {
case IEEE80211_ELEMID_VENDOR:
if (iswpaoui(ie))

File Metadata

Mime Type
text/plain
Expires
Sat, Feb 8, 2:13 PM (20 h, 53 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
16527510
Default Alt Text
D36245.diff (602 B)

Event Timeline