Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 2 Dec 2013 03:42:40 +0000 (UTC)
From:      Adrian Chadd <adrian@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r258824 - head/sys/dev/iwn
Message-ID:  <201312020342.rB23geHH092674@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: adrian
Date: Mon Dec  2 03:42:39 2013
New Revision: 258824
URL: http://svnweb.freebsd.org/changeset/base/258824

Log:
  Add some sanity checks to the TLV fetch.
  
  Obtained from:	Linux iwlwifi

Modified:
  head/sys/dev/iwn/if_iwn.c

Modified: head/sys/dev/iwn/if_iwn.c
==============================================================================
--- head/sys/dev/iwn/if_iwn.c	Mon Dec  2 03:40:51 2013	(r258823)
+++ head/sys/dev/iwn/if_iwn.c	Mon Dec  2 03:42:39 2013	(r258824)
@@ -7506,8 +7506,16 @@ iwn_read_firmware_tlv(struct iwn_softc *
 			DPRINTF(sc, IWN_DEBUG_RESET,
 			    "PAN Support found: %d\n", 1);
 			break;
-		case IWN_FW_TLV_FLAGS :
-			sc->tlv_feature_flags = htole32(*ptr);
+	case IWN_FW_TLV_FLAGS:
+			if (len < sizeof(uint32_t))
+				break;
+			if (len % sizeof(uint32_t))
+				break;
+			sc->tlv_feature_flags = le32toh(*ptr);
+			DPRINTF(sc, IWN_DEBUG_RESET,
+			    "%s: feature: 0x%08x\n",
+			    __func__,
+			    sc->tlv_feature_flags);
 			break;
 		case IWN_FW_TLV_PBREQ_MAXLEN:
 		case IWN_FW_TLV_RUNT_EVTLOG_PTR:



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201312020342.rB23geHH092674>