Author: adrian
Date: Mon Dec 2 03:42:39 2013
New Revision: 258824
URL: http://svnweb.freebsd.org/changeset/base/258824
Log:
Add some sanity checks to the TLV fetch.
Obtained from: Linux iwlwifi
Modified:
head/sys/dev/iwn/if_iwn.c
Modified: head/sys/dev/iwn/if_iwn.c
==============================================================================
--- head/sys/dev/iwn/if_iwn.c Mon Dec 2 03:40:51 2013 (r258823)
+++ head/sys/dev/iwn/if_iwn.c Mon Dec 2 03:42:39 2013 (r258824)
@@ -7506,8 +7506,16 @@ iwn_read_firmware_tlv(struct iwn_softc *
DPRINTF(sc, IWN_DEBUG_RESET,
"PAN Support found: %d\n", 1);
break;
- case IWN_FW_TLV_FLAGS :
- sc->tlv_feature_flags = htole32(*ptr);
+ case IWN_FW_TLV_FLAGS:
+ if (len < sizeof(uint32_t))
+ break;
+ if (len % sizeof(uint32_t))
+ break;
+ sc->tlv_feature_flags = le32toh(*ptr);
+ DPRINTF(sc, IWN_DEBUG_RESET,
+ "%s: feature: 0x%08x\n",
+ __func__,
+ sc->tlv_feature_flags);
break;
case IWN_FW_TLV_PBREQ_MAXLEN:
case IWN_FW_TLV_RUNT_EVTLOG_PTR:
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
