diff options
| author | Philip Guenthe <guenther@cvs.openbsd.org> | 2009-11-21 13:05:33 +0000 |
|---|---|---|
| committer | Philip Guenthe <guenther@cvs.openbsd.org> | 2009-11-21 13:05:33 +0000 |
| commit | 9495e9003ab6bf557833fa1b2641293d748bcd9a (patch) | |
| tree | 815ae731d25a84f7109a260d17e54c18273ae869 /sys/dev | |
| parent | cb9e8f5ce6398bbf3a336d8b9169f5222ed6501c (diff) | |
User triggerable KASSERT()s and NULL dereferences in netbt setsockopt()s,
found by Clement LECIGNE, localhost DoS everywhere. Also, don't leak
the mbuf when the wrong level is used.
ok claudio@, "just commit" deraadt@
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/bluetooth/bthidev.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/sys/dev/bluetooth/bthidev.c b/sys/dev/bluetooth/bthidev.c index 32d88a637e0..9908d971d67 100644 --- a/sys/dev/bluetooth/bthidev.c +++ b/sys/dev/bluetooth/bthidev.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bthidev.c,v 1.5 2008/11/24 08:49:22 uwe Exp $ */ +/* $OpenBSD: bthidev.c,v 1.6 2009/11/21 13:05:32 guenther Exp $ */ /* $NetBSD: bthidev.c,v 1.16 2008/08/06 15:01:23 plunky Exp $ */ /*- @@ -451,7 +451,7 @@ bthidev_listen(struct bthidev_softc *sc) if (err) return err; - err = l2cap_setopt(sc->sc_ctl_l, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_ctl_l, sc->sc_mode); if (err) return err; @@ -471,7 +471,7 @@ bthidev_listen(struct bthidev_softc *sc) if (err) return err; - err = l2cap_setopt(sc->sc_int_l, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_int_l, sc->sc_mode); if (err) return err; @@ -512,7 +512,7 @@ bthidev_connect(struct bthidev_softc *sc) return err; } - err = l2cap_setopt(sc->sc_ctl, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_ctl, sc->sc_mode); if (err) return err; @@ -570,7 +570,7 @@ bthidev_ctl_connected(void *arg) if (err) goto fail; - err = l2cap_setopt(sc->sc_int, SO_L2CAP_LM, &sc->sc_mode); + err = l2cap_setlinkmode(sc->sc_int, sc->sc_mode); if (err) goto fail; |