From 53aa29072a37c7a6f33c06f90c809b0dfef909b6 Mon Sep 17 00:00:00 2001 From: adrian Date: Sat, 3 Oct 2015 15:52:58 +0000 Subject: [PATCH] rum(4): check mbuf size before accessing its contents Submitted by: Differential Revision: https://reviews.freebsd.org/D3610 --- sys/dev/usb/wlan/if_rum.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/sys/dev/usb/wlan/if_rum.c b/sys/dev/usb/wlan/if_rum.c index 6b9cd9f72fda..b9d657f48f6a 100644 --- a/sys/dev/usb/wlan/if_rum.c +++ b/sys/dev/usb/wlan/if_rum.c @@ -912,6 +912,7 @@ rum_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) { struct rum_softc *sc = usbd_xfer_softc(xfer); struct ieee80211com *ic = &sc->sc_ic; + struct ieee80211_frame_min *wh; struct ieee80211_node *ni; struct mbuf *m = NULL; struct usb_page_cache *pc; @@ -959,6 +960,8 @@ rum_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) usbd_copy_out(pc, RT2573_RX_DESC_SIZE, mtod(m, uint8_t *), len); + wh = mtod(m, struct ieee80211_frame_min *); + /* finalize mbuf */ m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff; @@ -987,8 +990,11 @@ tr_setup: */ RUM_UNLOCK(sc); if (m) { - ni = ieee80211_find_rxnode(ic, - mtod(m, struct ieee80211_frame_min *)); + if (m->m_len >= sizeof(struct ieee80211_frame_min)) + ni = ieee80211_find_rxnode(ic, wh); + else + ni = NULL; + if (ni != NULL) { (void) ieee80211_input(ni, m, rssi, RT2573_NOISE_FLOOR); -- 2.41.0