49 lines
1.9 KiB
Diff
49 lines
1.9 KiB
Diff
diff -urN madwifi-ng-r2377-20070526.old/net80211/ieee80211_input.c madwifi-ng-r2377-20070526.dev/net80211/ieee80211_input.c
|
|
--- madwifi-ng-r2377-20070526.old/net80211/ieee80211_input.c 2007-05-21 17:53:39.000000000 +0200
|
|
+++ madwifi-ng-r2377-20070526.dev/net80211/ieee80211_input.c 2007-05-26 18:51:09.027715120 +0200
|
|
@@ -695,13 +695,31 @@
|
|
|
|
/* NB: assumes linear (i.e., non-fragmented) skb */
|
|
|
|
+ /* check length > header */
|
|
+ if (skb->len < sizeof(struct ether_header) + LLC_SNAPFRAMELEN
|
|
+ + roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2) {
|
|
+ IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
|
|
+ ni->ni_macaddr, "data", "%s", "decap error");
|
|
+ vap->iv_stats.is_rx_decap++;
|
|
+ IEEE80211_NODE_STAT(ni, rx_decap);
|
|
+ goto err;
|
|
+ }
|
|
+
|
|
/* get to the tunneled headers */
|
|
ath_hdr = (struct athl2p_tunnel_hdr *)
|
|
skb_pull(skb, sizeof(struct ether_header) + LLC_SNAPFRAMELEN);
|
|
- /* ignore invalid frames */
|
|
- if(ath_hdr == NULL)
|
|
+ eh_tmp = (struct ether_header *)
|
|
+ skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
|
|
+ /* sanity check for malformed 802.3 length */
|
|
+ frame_len = ntohs(eh_tmp->ether_type);
|
|
+ if (skb->len < roundup(sizeof(struct ether_header) + frame_len, 4)) {
|
|
+ IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
|
|
+ ni->ni_macaddr, "data", "%s", "decap error");
|
|
+ vap->iv_stats.is_rx_decap++;
|
|
+ IEEE80211_NODE_STAT(ni, rx_decap);
|
|
goto err;
|
|
-
|
|
+ }
|
|
+
|
|
/* only implementing FF now. drop all others. */
|
|
if (ath_hdr->proto != ATH_L2TUNNEL_PROTO_FF) {
|
|
IEEE80211_DISCARD_MAC(vap,
|
|
@@ -714,10 +732,6 @@
|
|
}
|
|
vap->iv_stats.is_rx_ffcnt++;
|
|
|
|
- /* move past the tunneled header, with alignment */
|
|
- skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
|
|
- eh_tmp = (struct ether_header *)skb->data;
|
|
-
|
|
/* ether_type must be length as FF frames are always LLC/SNAP encap'd */
|
|
frame_len = ntohs(eh_tmp->ether_type);
|
|
|