Author: cy
Date: Tue Aug 21 19:17:35 2018
New Revision: 338154
URL: https://svnweb.freebsd.org/changeset/base/338154
Log:
For CID 1394785, add a comment explaining that global->event_buf is
not really a char * but a struct rt_msghdr *.
MFC after: 3 days
Modified:
head/contrib/wpa/src/drivers/driver_bsd.c
Modified: head/contrib/wpa/src/drivers/driver_bsd.c
==============================================================================
--- head/contrib/wpa/src/drivers/driver_bsd.c Tue Aug 21 18:50:29 2018
(r338153)
+++ head/contrib/wpa/src/drivers/driver_bsd.c Tue Aug 21 19:17:35 2018
(r338154)
@@ -1234,6 +1234,11 @@ wpa_driver_bsd_event_receive(int sock, void *ctx, void
struct ieee80211_join_event *join;
int n;
+ /*
+ * CID 1394785: Memory - illegal access (STRING_NULL):
+ * Though global->event_buf is a char *, it actually contains
+ * a struct rt_msghdr *. See below.
+ */
n = read(sock, global->event_buf, global->event_buf_len);
if (n < 0) {
if (errno != EINTR && errno != EAGAIN)
@@ -1242,6 +1247,10 @@ wpa_driver_bsd_event_receive(int sock, void *ctx, void
return;
}
+ /*
+ * CID 1394785: global->event_buf is assigned here to a
+ * struct rt_msghdr *.
+ */
rtm = (struct rt_msghdr *) global->event_buf;
if (rtm->rtm_version != RTM_VERSION) {
wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
