From 21d0a42ee92e729593e5ddb5d6fdbc727b427b5f Mon Sep 17 00:00:00 2001 From: imp Date: Sun, 29 Sep 2002 18:40:35 +0000 Subject: Limit the TX key to a valid range PR: 39960, 39961 (patches here pointed out problem, but didn't quite fix it) --- sys/dev/wi/if_wi.c | 6 ++++++ sys/dev/wi/if_wivar.h | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) (limited to 'sys/dev') diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c index 1c00a6b..9fdc0c5 100644 --- a/sys/dev/wi/if_wi.c +++ b/sys/dev/wi/if_wi.c @@ -1268,6 +1268,8 @@ wi_write_record(sc, ltv) ltv = &p2ltv; break; case WI_RID_TX_CRYPT_KEY: + if (ltv->wi_val > WI_NLTV_KEYS) + return (EINVAL); p2ltv.wi_type = WI_RID_P2_TX_CRYPT_KEY; p2ltv.wi_len = 2; p2ltv.wi_val = ltv->wi_val; @@ -1328,6 +1330,10 @@ wi_write_record(sc, ltv) case 11: ltv->wi_val = 5; break; /* 11Mb/s fixed */ default: return EINVAL; } + case WI_RID_TX_CRYPT_KEY: + if (ltv->wi_val > WI_NLTV_KEYS) + return (EINVAL); + break; } } diff --git a/sys/dev/wi/if_wivar.h b/sys/dev/wi/if_wivar.h index e615e0b..92d908d 100644 --- a/sys/dev/wi/if_wivar.h +++ b/sys/dev/wi/if_wivar.h @@ -85,10 +85,11 @@ struct wi_key { u_int8_t wi_keydat[14]; }; +#define WI_NLTV_KEYS 4 struct wi_ltv_keys { u_int16_t wi_len; u_int16_t wi_type; - struct wi_key wi_keys[4]; + struct wi_key wi_keys[WI_NLTV_KEYS]; }; struct wi_softc { -- cgit v1.1