diff options
| author | Stefan Sperling <stsp@cvs.openbsd.org> | 2017-07-20 22:29:27 +0000 |
|---|---|---|
| committer | Stefan Sperling <stsp@cvs.openbsd.org> | 2017-07-20 22:29:27 +0000 |
| commit | df010582cf2c5fda9fdc0299df2a6f842cd85af5 (patch) | |
| tree | 55209e7d4f05d4f768f80014caea91a02689f968 /sys/dev | |
| parent | 53705effaf1eb75b381481ac11bd3286f6e162d0 (diff) | |
Make otus(4) drop frames larger than MCLBYTES.
Problem reported by Ilja Van Sprundel.
ok deraadt@ tb@
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/usb/if_otus.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/dev/usb/if_otus.c b/sys/dev/usb/if_otus.c index b63ccc75e58..d10017d61ee 100644 --- a/sys/dev/usb/if_otus.c +++ b/sys/dev/usb/if_otus.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_otus.c,v 1.58 2017/07/03 09:21:09 kevlo Exp $ */ +/* $OpenBSD: if_otus.c,v 1.59 2017/07/20 22:29:26 stsp Exp $ */ /*- * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr> @@ -1114,6 +1114,11 @@ otus_sub_rxeof(struct otus_softc *sc, uint8_t *buf, int len) return; } mlen -= IEEE80211_CRC_LEN; /* strip 802.11 FCS */ + if (mlen > MCLBYTES) { + DPRINTF(("frame too large: %d\n", mlen)); + ifp->if_ierrors++; + return; + } wh = (struct ieee80211_frame *)(plcp + AR_PLCP_HDR_LEN); /* Provide a 32-bit aligned protocol header to the stack. */ |