svn commit: r338154 - head/contrib/wpa/src/drivers

[Cy Schubert]

Author: cy
Date: Tue Aug 21 19:17:35 2018
New Revision: 338154
URL: https://svnweb.freebsd.org/changeset/base/338154

Log:
  For CID 1394785, add a comment explaining that global->event_buf is
  not really a char * but a struct rt_msghdr *.
  
  MFC after:	3 days

Modified:
  head/contrib/wpa/src/drivers/driver_bsd.c

Modified: head/contrib/wpa/src/drivers/driver_bsd.c
==============================================================================
--- head/contrib/wpa/src/drivers/driver_bsd.c	Tue Aug 21 18:50:29 2018	(r338153)
+++ head/contrib/wpa/src/drivers/driver_bsd.c	Tue Aug 21 19:17:35 2018	(r338154)
@@ -1234,6 +1234,11 @@ wpa_driver_bsd_event_receive(int sock, void *ctx, void
 	struct ieee80211_join_event *join;
 	int n;
 
+	/*
+	 * CID 1394785: Memory - illegal access (STRING_NULL):
+	 * Though global->event_buf is a char *, it actually contains
+	 * a struct rt_msghdr *. See below.
+	 */
 	n = read(sock, global->event_buf, global->event_buf_len);
 	if (n < 0) {
 		if (errno != EINTR && errno != EAGAIN)
@@ -1242,6 +1247,10 @@ wpa_driver_bsd_event_receive(int sock, void *ctx, void
 		return;
 	}
 
+	/*
+	 * CID 1394785: global->event_buf is assigned here to a
+	 * struct rt_msghdr *.
+	 */
 	rtm = (struct rt_msghdr *) global->event_buf;
 	if (rtm->rtm_version != RTM_VERSION) {
 		wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",