svn commit: r271303 - head/sys/dev/usb/wlan

[Kevin Lo]

Author: kevlo
Date: Tue Sep  9 05:21:31 2014
New Revision: 271303
URL: http://svnweb.freebsd.org/changeset/base/271303

Log:
  Drop frames that have larger than MCLBYTES.

Modified:
  head/sys/dev/usb/wlan/if_urtwn.c

Modified: head/sys/dev/usb/wlan/if_urtwn.c
==============================================================================
--- head/sys/dev/usb/wlan/if_urtwn.c	Tue Sep  9 04:20:53 2014	(r271302)
+++ head/sys/dev/usb/wlan/if_urtwn.c	Tue Sep  9 05:21:31 2014	(r271303)
@@ -660,6 +660,10 @@ urtwn_rx_frame(struct urtwn_softc *sc, u
 		ifp->if_ierrors++;
 		return (NULL);
 	}
+	if (pktlen < sizeof(*wh) || pktlen > MCLBYTES) {
+		ifp->if_ierrors++;
+		return (NULL);
+	}
 
 	rate = MS(rxdw3, R92C_RXDW3_RATE);
 	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;