diff options
| author |   guenther <guenther@openbsd.org> | 2009-11-21 13:05:32 +0000 |
|---|---|---|
| committer | guenther <guenther@openbsd.org> | 2009-11-21 13:05:32 +0000 |
| commit | 2c2ec14bdfd63302b9884d8efce7ebafb1711c97 (patch) | |
| tree | 560e89f9fc7a818e89d7acfef7bbe1a3bc6338ff /sys/dev/bluetooth/bthidev.c | |
| parent | remove unused variable (diff) | |
| download | wireguard-openbsd-2c2ec14bdfd63302b9884d8efce7ebafb1711c97.tar.xz wireguard-openbsd-2c2ec14bdfd63302b9884d8efce7ebafb1711c97.zip | |
User triggerable KASSERT()s and NULL dereferences in netbt setsockopt()s,
found by Clement LECIGNE, localhost DoS everywhere. Also, don't leak
the mbuf when the wrong level is used.
ok claudio@, "just commit" deraadt@
Diffstat (limited to 'sys/dev/bluetooth/bthidev.c')
| -rw-r--r-- | sys/dev/bluetooth/bthidev.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/dev/bluetooth/bthidev.c b/sys/dev/bluetooth/bthidev.c index 32d88a637e0..9908d971d67 100644 --- a/sys/dev/bluetooth/bthidev.c +++ b/sys/dev/bluetooth/bthidev.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bthidev.c,v 1.5 2008/11/24 08:49:22 uwe Exp $ */ +/* $OpenBSD: bthidev.c,v 1.6 2009/11/21 13:05:32 guenther Exp $ */ /* $NetBSD: bthidev.c,v 1.16 2008/08/06 15:01:23 plunky Exp $ */ /*- @@ -451,7 +451,7 @@ bthidev_listen(struct bthidev_softc *sc) if (err) return err; - err = l2cap_setopt(sc->sc_ctl_l, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_ctl_l, sc->sc_mode); if (err) return err; @@ -471,7 +471,7 @@ bthidev_listen(struct bthidev_softc *sc) if (err) return err; - err = l2cap_setopt(sc->sc_int_l, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_int_l, sc->sc_mode); if (err) return err; @@ -512,7 +512,7 @@ bthidev_connect(struct bthidev_softc *sc) return err; } - err = l2cap_setopt(sc->sc_ctl, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_ctl, sc->sc_mode); if (err) return err; @@ -570,7 +570,7 @@ bthidev_ctl_connected(void *arg) if (err) goto fail; - err = l2cap_setopt(sc->sc_int, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_int, sc->sc_mode); if (err) goto fail; |