svn commit: r258824 - head/sys/dev/iwn

[Adrian Chadd]

Author: adrian
Date: Mon Dec  2 03:42:39 2013
New Revision: 258824
URL: http://svnweb.freebsd.org/changeset/base/258824

Log:
  Add some sanity checks to the TLV fetch.
  
  Obtained from:	Linux iwlwifi

Modified:
  head/sys/dev/iwn/if_iwn.c

Modified: head/sys/dev/iwn/if_iwn.c
==============================================================================
--- head/sys/dev/iwn/if_iwn.c	Mon Dec  2 03:40:51 2013	(r258823)
+++ head/sys/dev/iwn/if_iwn.c	Mon Dec  2 03:42:39 2013	(r258824)
@@ -7506,8 +7506,16 @@ iwn_read_firmware_tlv(struct iwn_softc *
 			DPRINTF(sc, IWN_DEBUG_RESET,
 			    "PAN Support found: %d\n", 1);
 			break;
-		case IWN_FW_TLV_FLAGS :
-			sc->tlv_feature_flags = htole32(*ptr);
+	case IWN_FW_TLV_FLAGS:
+			if (len < sizeof(uint32_t))
+				break;
+			if (len % sizeof(uint32_t))
+				break;
+			sc->tlv_feature_flags = le32toh(*ptr);
+			DPRINTF(sc, IWN_DEBUG_RESET,
+			    "%s: feature: 0x%08x\n",
+			    __func__,
+			    sc->tlv_feature_flags);
 			break;
 		case IWN_FW_TLV_PBREQ_MAXLEN:
 		case IWN_FW_TLV_RUNT_EVTLOG_PTR: