1
0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-11-05 08:19:43 +02:00
openwrt-xburst/package/madwifi/patches/119-secfix_PR_1335.patch
nbd e84fbded98 update madwifi to latest trunk - performance enhancements
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@7341 3c298f89-4303-0410-b956-a3cf2f4a3e73
2007-05-26 16:52:05 +00:00

50 lines
1.9 KiB
Diff

diff -urN madwifi-ng-r2377-20070526.old/net80211/ieee80211_input.c madwifi-ng-r2377-20070526.dev/net80211/ieee80211_input.c
--- madwifi-ng-r2377-20070526.old/net80211/ieee80211_input.c 2007-05-21 17:53:39.000000000 +0200
+++ madwifi-ng-r2377-20070526.dev/net80211/ieee80211_input.c 2007-05-26 18:51:09.027715120 +0200
@@ -695,13 +695,31 @@
/* NB: assumes linear (i.e., non-fragmented) skb */
+ /* check length > header */
+ if (skb->len < sizeof(struct ether_header) + LLC_SNAPFRAMELEN
+ + roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2) {
+ IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
+ ni->ni_macaddr, "data", "%s", "decap error");
+ vap->iv_stats.is_rx_decap++;
+ IEEE80211_NODE_STAT(ni, rx_decap);
+ goto err;
+ }
+
/* get to the tunneled headers */
ath_hdr = (struct athl2p_tunnel_hdr *)
skb_pull(skb, sizeof(struct ether_header) + LLC_SNAPFRAMELEN);
- /* ignore invalid frames */
- if(ath_hdr == NULL)
+ eh_tmp = (struct ether_header *)
+ skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
+ /* sanity check for malformed 802.3 length */
+ frame_len = ntohs(eh_tmp->ether_type);
+ if (skb->len < roundup(sizeof(struct ether_header) + frame_len, 4)) {
+ IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
+ ni->ni_macaddr, "data", "%s", "decap error");
+ vap->iv_stats.is_rx_decap++;
+ IEEE80211_NODE_STAT(ni, rx_decap);
goto err;
-
+ }
+
/* only implementing FF now. drop all others. */
if (ath_hdr->proto != ATH_L2TUNNEL_PROTO_FF) {
IEEE80211_DISCARD_MAC(vap,
@@ -714,10 +732,6 @@
}
vap->iv_stats.is_rx_ffcnt++;
- /* move past the tunneled header, with alignment */
- skb_pull(skb, roundup(sizeof(struct athl2p_tunnel_hdr) - 2, 4) + 2);
- eh_tmp = (struct ether_header *)skb->data;
-
/* ether_type must be length as FF frames are always LLC/SNAP encap'd */
frame_len = ntohs(eh_tmp->ether_type);