Ticket #428: len-check.diff

net80211/ieee80211_input.c

@@ -2272 +2272 @@
-                scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
-                scan.chan = scan.bchan;
-
-
-IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
+ && frm[1] < efrm - frm
+
-                        switch (*frm) {
-                        case IEEE80211_ELEMID_SSID:
-                                scan.ssid = frm;
@@ -2343 +2343 @@
-                        }
-                        frm += frm[1] + 2;
-                }
-
-
+
-                IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
-                IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
-#if IEEE80211_CHAN_MAX < 255
@@ -2538 +2537 @@
-                 *      [tlv] Atheros Advanced Capabilities
-                 */
-                ssid = rates = xrates = ath = NULL;
-
-
+
-                        switch (*frm) {
-                        case IEEE80211_ELEMID_SSID:
-                                ssid = frm;
@@ -2558 +2556 @@
-                        }
-                        frm += frm[1] + 2;
-                }
-
-
+
-                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
-                IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
-                IEEE80211_VERIFY_SSID(vap->iv_bss, ssid);
@@ -2742 +2739 @@
-                if (reassoc)
-                        frm += 6;       /* ignore current AP info */
-                ssid = rates = xrates = wpa = rsn = wme = ath = NULL;
-
-
+
-                        switch (*frm) {
-                        case IEEE80211_ELEMID_SSID:
-                                ssid = frm;
@@ -2785 +2781 @@
-                        }
-                        frm += frm[1] + 2;
-                }
-
-
+
-                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
-                IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
-                IEEE80211_VERIFY_SSID(vap->iv_bss, ssid);
@@ -3024 +3019 @@
-                frm += 2;
-
-                rates = xrates = wme = NULL;
-
-       IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
+ && frm[1] < efrm - frm
+
-                        switch (*frm) {
-                        case IEEE80211_ELEMID_RATES:
-                                rates = frm;
@@ -3040 +3035 @@
-                        }
-                        frm += frm[1] + 2;
-                }
-
-
+
-                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
-                rate = ieee80211_setup_rates(ni, rates, xrates,
-                        IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |