svn commit: r289012 - head/sys/dev/wpi

[Adrian Chadd]

Author: adrian
Date: Thu Oct  8 07:22:40 2015
New Revision: 289012
URL: https://svnweb.freebsd.org/changeset/base/289012

Log:
  wpi(4): check size before transmitting frames
  
  In addition to https://bz-attachments.freebsd.org/attachment.cgi?id=156112;
  fixes https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=144987.
  
  Tested:
  
  * Tested with Intel 3945BG, STA mode
  
  Submitted by:	<s3erios at gmail.com>
  Differential Revision:	https://reviews.freebsd.org/D3762

Modified:
  head/sys/dev/wpi/if_wpi.c

Modified: head/sys/dev/wpi/if_wpi.c
==============================================================================
--- head/sys/dev/wpi/if_wpi.c	Thu Oct  8 07:21:36 2015	(r289011)
+++ head/sys/dev/wpi/if_wpi.c	Thu Oct  8 07:22:40 2015	(r289012)
@@ -2603,6 +2603,11 @@ wpi_cmd2(struct wpi_softc *sc, struct wp
 	hdrlen = ieee80211_anyhdrsize(wh);
 	totlen = buf->m->m_pkthdr.len;
 
+	if (__predict_false(totlen < sizeof(struct ieee80211_frame_min))) {
+		error = EINVAL;
+		goto fail;
+	}
+
 	if (hdrlen & 3) {
 		/* First segment length must be a multiple of 4. */
 		pad = 4 - (hdrlen & 3);