Ticket #1335: 01_secfix-0.9.3-sizecheck-take3.patch

madwifi-0.9.3/net80211/ieee80211_input.c

@@ -693 +693 @@
-
-                        /* NB: assumes linear (i.e., non-fragmented) skb */
-
+                        /* check length > header */
+                        if (skb->len < sizeof(struct ether_header) + LLC_SNAPFRAMELEN
+                            + roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2) {
+                                IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
+                                        ni->ni_macaddr, "data", "%s", "decap error");
+                                        vap->iv_stats.is_rx_decap++;
+                                IEEE80211_NODE_STAT(ni, rx_decap);
+                                goto err;
+                        }
+
-                        /* get to the tunneled headers */
-                        ath_hdr = (struct athl2p_tunnel_hdr *)
-                                skb_pull(skb, sizeof(struct ether_header) + LLC_SNAPFRAMELEN);
-
-
+
+
+
+
+
+
+
+
+
-                                goto err;
-
+
+
-                        /* only implementing FF now. drop all others. */
-                        if (ath_hdr->proto != ATH_L2TUNNEL_PROTO_FF) {
-                                IEEE80211_DISCARD_MAC(vap,
@@ -712 +730 @@
-                        }
-                        vap->iv_stats.is_rx_ffcnt++;
-                        
-                        /* move past the tunneled header, with alignment */
-                        skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
-
-                        skb1 = skb_clone(skb, GFP_ATOMIC); /* XXX: GFP_ATOMIC is overkill? */
-                        eh_tmp = (struct ether_header *)skb->data;
-
-                        /* ether_type must be length*/
-                        frame_len = ntohs(eh_tmp->ether_type);
-
-                        /* we now have 802.3 MAC hdr followed by 802.2 LLC/SNAP. convert to DIX */
-                        athff_decap(skb);
@@ -729 +740 @@
-
-                        /* prepare second tunneled frame */
-                        skb_pull(skb1, roundup(sizeof(struct ether_header) + frame_len, 4));
-                        eh_tmp = (struct ether_header *)skb1->data;
-                        frame_len = ntohs(eh_tmp->ether_type);
-                        athff_decap(skb1);
-
-                        /* deliver the frames */