diff options
| author | avos <avos@FreeBSD.org> | 2016-01-07 18:41:03 +0000 |
|---|---|---|
| committer | avos <avos@FreeBSD.org> | 2016-01-07 18:41:03 +0000 |
| commit | 252aa9ecdf74fb3dcb03b24e1f99ae5d58d3b742 (patch) | |
| tree | 29432600c74c3421aff456667f70f13cde56fddc /sys/dev/rtwn | |
| parent | f0fdf5da87facac461a6cf7a009493b80f453c3b (diff) | |
| download | FreeBSD-src-252aa9ecdf74fb3dcb03b24e1f99ae5d58d3b742.zip FreeBSD-src-252aa9ecdf74fb3dcb03b24e1f99ae5d58d3b742.tar.gz | |
net80211 drivers: fix ieee80211_init_channels() usage
Fix out-of-bounds read (all) / write (11n capable) for drivers
that are using ieee80211_init_channels() to initialize channel list.
Tested with:
* RTL8188EU, STA mode.
* RTL8188CUS, STA mode.
* WUSB54GC, HOSTAP mode.
Approved by: adrian (mentor)
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D4818
Diffstat (limited to 'sys/dev/rtwn')
| -rw-r--r-- | sys/dev/rtwn/if_rtwn.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/dev/rtwn/if_rtwn.c b/sys/dev/rtwn/if_rtwn.c index 6fedf7d..ec17cdc 100644 --- a/sys/dev/rtwn/if_rtwn.c +++ b/sys/dev/rtwn/if_rtwn.c @@ -251,7 +251,7 @@ rtwn_attach(device_t dev) struct rtwn_softc *sc = device_get_softc(dev); struct ieee80211com *ic = &sc->sc_ic; uint32_t lcsr; - uint8_t bands; + uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)]; int i, count, error, rid; sc->sc_dev = dev; @@ -353,10 +353,10 @@ rtwn_attach(device_t dev) | IEEE80211_C_WME /* 802.11e */ ; - bands = 0; - setbit(&bands, IEEE80211_MODE_11B); - setbit(&bands, IEEE80211_MODE_11G); - ieee80211_init_channels(ic, NULL, &bands); + memset(bands, 0, sizeof(bands)); + setbit(bands, IEEE80211_MODE_11B); + setbit(bands, IEEE80211_MODE_11G); + ieee80211_init_channels(ic, NULL, bands); ieee80211_ifattach(ic); |
