diff options
| author | Damien Bergamini <damien@cvs.openbsd.org> | 2008-07-23 15:55:47 +0000 |
|---|---|---|
| committer | Damien Bergamini <damien@cvs.openbsd.org> | 2008-07-23 15:55:47 +0000 |
| commit | 0e9bfb011889f0208ad4c3ed98064ffcef6bebf7 (patch) | |
| tree | 55cec5634d5464010601f7d360bf804485b5d0be /sys | |
| parent | 27fb5e5cb3d7c3285bde94853e9d912c3abe40c8 (diff) | |
Fix a blatant misuse of MINCLSIZE I introduced in ieee80211_output.c r1.59
The bug was added on 04/16 but it started to show up only after 06/12 when
the value of MINCLSIZE was changed to something different from MHLEN + 1.
Thanks to dlg@ and giovanni (qgiovanni at gmail dot com) for putting me
on the right track.
Tested by giovanni.
Should fix system/5881 too.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/net80211/ieee80211_output.c | 4 | ||||
| -rw-r--r-- | sys/net80211/ieee80211_pae_output.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c index 59ea1c4c0d5..875e95b64e3 100644 --- a/sys/net80211/ieee80211_output.c +++ b/sys/net80211/ieee80211_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_output.c,v 1.61 2008/07/21 19:27:26 damien Exp $ */ +/* $OpenBSD: ieee80211_output.c,v 1.62 2008/07/23 15:55:46 damien Exp $ */ /* $NetBSD: ieee80211_output.c,v 1.13 2004/05/31 11:02:55 dyoung Exp $ */ /*- @@ -951,7 +951,7 @@ ieee80211_getmgmt(int flags, int type, u_int pktlen) MGETHDR(m, flags, type); if (m == NULL) return NULL; - if (pktlen >= MINCLSIZE) { + if (pktlen > MHLEN) { MCLGET(m, flags); if (!(m->m_flags & M_EXT)) return m_free(m); diff --git a/sys/net80211/ieee80211_pae_output.c b/sys/net80211/ieee80211_pae_output.c index 6235c99b3a7..52f51e64bfa 100644 --- a/sys/net80211/ieee80211_pae_output.c +++ b/sys/net80211/ieee80211_pae_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_pae_output.c,v 1.2 2008/07/21 19:27:26 damien Exp $ */ +/* $OpenBSD: ieee80211_pae_output.c,v 1.3 2008/07/23 15:55:46 damien Exp $ */ /*- * Copyright (c) 2007,2008 Damien Bergamini <damien.bergamini@free.fr> @@ -212,7 +212,7 @@ ieee80211_get_eapol_key(int flags, int type, u_int pktlen) MGETHDR(m, flags, type); if (m == NULL) return NULL; - if (pktlen >= MINCLSIZE) { + if (pktlen > MHLEN) { MCLGET(m, flags); if (!(m->m_flags & M_EXT)) return m_free(m); |