diff options
| author | imp <imp@FreeBSD.org> | 2002-09-29 18:40:35 +0000 |
|---|---|---|
| committer | imp <imp@FreeBSD.org> | 2002-09-29 18:40:35 +0000 |
| commit | 21d0a42ee92e729593e5ddb5d6fdbc727b427b5f (patch) | |
| tree | 0f2c50df0fc00231d1b5539b26b38aef39cee467 /sys/dev | |
| parent | 1e13fe949738da63e191078330127971c442f858 (diff) | |
| download | FreeBSD-src-21d0a42ee92e729593e5ddb5d6fdbc727b427b5f.zip FreeBSD-src-21d0a42ee92e729593e5ddb5d6fdbc727b427b5f.tar.gz | |
Limit the TX key to a valid range
PR: 39960, 39961 (patches here pointed out problem, but didn't quite fix it)
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/wi/if_wi.c | 6 | ||||
| -rw-r--r-- | sys/dev/wi/if_wivar.h | 3 |
2 files changed, 8 insertions, 1 deletions
diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c index 1c00a6b..9fdc0c5 100644 --- a/sys/dev/wi/if_wi.c +++ b/sys/dev/wi/if_wi.c @@ -1268,6 +1268,8 @@ wi_write_record(sc, ltv) ltv = &p2ltv; break; case WI_RID_TX_CRYPT_KEY: + if (ltv->wi_val > WI_NLTV_KEYS) + return (EINVAL); p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY; p2ltv.wi_len = 2; p2ltv.wi_val = ltv->wi_val; @@ -1328,6 +1330,10 @@ wi_write_record(sc, ltv) case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */ default: return EINVAL; } + case WI_RID_TX_CRYPT_KEY: + if (ltv->wi_val > WI_NLTV_KEYS) + return (EINVAL); + break; } } diff --git a/sys/dev/wi/if_wivar.h b/sys/dev/wi/if_wivar.h index e615e0b..92d908d 100644 --- a/sys/dev/wi/if_wivar.h +++ b/sys/dev/wi/if_wivar.h @@ -85,10 +85,11 @@ struct wi_key { u_int8_t wi_keydat[14]; }; +#define WI_NLTV_KEYS 4 struct wi_ltv_keys { u_int16_t wi_len; u_int16_t wi_type; - struct wi_key wi_keys[4]; + struct wi_key wi_keys[WI_NLTV_KEYS]; }; struct wi_softc { |
