summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorderaadt <deraadt@openbsd.org>2015-09-06 04:09:59 +0000
committerderaadt <deraadt@openbsd.org>2015-09-06 04:09:59 +0000
commit8e03951bbfd835daf75b8ea8443100e6e59a7dfb (patch)
tree4c3e2204fcfae3167c5ecff9a53d7ac00dd3ef65
parentWhen rand() was made fully random, the return value of srand() was (diff)
downloadwireguard-openbsd-8e03951bbfd835daf75b8ea8443100e6e59a7dfb.tar.xz
wireguard-openbsd-8e03951bbfd835daf75b8ea8443100e6e59a7dfb.zip
sizes for free() - most are about the firmware memory
-rw-r--r--sys/dev/pci/if_wpi.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/dev/pci/if_wpi.c b/sys/dev/pci/if_wpi.c
index dce2e1e7b8b..42fc5025976 100644
--- a/sys/dev/pci/if_wpi.c
+++ b/sys/dev/pci/if_wpi.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: if_wpi.c,v 1.127 2015/05/27 22:10:52 kettenis Exp $ */
+/* $OpenBSD: if_wpi.c,v 1.128 2015/09/06 04:09:59 deraadt Exp $ */
/*-
* Copyright (c) 2006-2008
@@ -2622,7 +2622,7 @@ wpi_scan(struct wpi_softc *sc, uint16_t flags)
DPRINTF(("sending scan command nchan=%d\n", hdr->nchan));
error = wpi_cmd(sc, WPI_CMD_SCAN, buf, buflen, 1);
- free(buf, M_DEVBUF, 0);
+ free(buf, M_DEVBUF, WPI_SCAN_MAXSZ);
return error;
}
@@ -2979,7 +2979,7 @@ wpi_read_firmware(struct wpi_softc *sc)
if (size < sizeof (*hdr)) {
printf("%s: truncated firmware header: %zu bytes\n",
sc->sc_dev.dv_xname, size);
- free(fw->data, M_DEVBUF, 0);
+ free(fw->data, M_DEVBUF, size);
return EINVAL;
}
/* Extract firmware header information. */
@@ -2999,7 +2999,7 @@ wpi_read_firmware(struct wpi_softc *sc)
fw->boot.textsz > WPI_FW_BOOT_TEXT_MAXSZ ||
(fw->boot.textsz & 3) != 0) {
printf("%s: invalid firmware header\n", sc->sc_dev.dv_xname);
- free(fw->data, M_DEVBUF, 0);
+ free(fw->data, M_DEVBUF, size);
return EINVAL;
}
@@ -3008,7 +3008,7 @@ wpi_read_firmware(struct wpi_softc *sc)
fw->init.textsz + fw->init.datasz + fw->boot.textsz) {
printf("%s: firmware file too short: %zu bytes\n",
sc->sc_dev.dv_xname, size);
- free(fw->data, M_DEVBUF, 0);
+ free(fw->data, M_DEVBUF, size);
return EINVAL;
}