diff options
| author |   stsp <stsp@openbsd.org> | 2017-07-20 22:29:26 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2017-07-20 22:29:26 +0000 |
| commit | 7cdb832a9697ccc221562335bfd16af4ffe390ff (patch) | |
| tree | 891550ee99cf5cdae532272e153a4b5540a1de05 | |
| parent | extra test because mk38 triggers two issues and fixing the first one (diff) | |
| download | wireguard-openbsd-7cdb832a9697ccc221562335bfd16af4ffe390ff.tar.xz wireguard-openbsd-7cdb832a9697ccc221562335bfd16af4ffe390ff.zip | |
Make otus(4) drop frames larger than MCLBYTES.
Problem reported by Ilja Van Sprundel.
ok deraadt@ tb@
| -rw-r--r-- | sys/dev/usb/if_otus.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/dev/usb/if_otus.c b/sys/dev/usb/if_otus.c index b63ccc75e58..d10017d61ee 100644 --- a/sys/dev/usb/if_otus.c +++ b/sys/dev/usb/if_otus.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_otus.c,v 1.58 2017/07/03 09:21:09 kevlo Exp $ */ +/* $OpenBSD: if_otus.c,v 1.59 2017/07/20 22:29:26 stsp Exp $ */ /*- * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr> @@ -1114,6 +1114,11 @@ otus_sub_rxeof(struct otus_softc *sc, uint8_t *buf, int len) return; } mlen -= IEEE80211_CRC_LEN; /* strip 802.11 FCS */ + if (mlen > MCLBYTES) { + DPRINTF(("frame too large: %d\n", mlen)); + ifp->if_ierrors++; + return; + } wh = (struct ieee80211_frame *)(plcp + AR_PLCP_HDR_LEN); /* Provide a 32-bit aligned protocol header to the stack. */ |