Searched hist:"09 dd08f1" (Results 1 – 1 of 1) sorted by relevance
/freebsd/sys/net80211/ |
H A D | ieee80211_node.c | 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340 09dd08f1 Wed Oct 06 18:09:39 GMT 2021 Bjoern A. Zeeb <bz@FreeBSD.org> net80211: correct length check in ieee80211_ies_expand()
In ieee80211_ies_expand() we are looping over Elements (also known as Information Elements or IEs). The comment suggests that we assume well-formedness of the IEs themselves. Checking the buffer length being least 2 (1 byte Element ID and 1 byte Length fields) rather than just 1 before accessing ie[1] is still good practise and can prevent and out-of-bounds read in case the input is not behaving according to the comment.
Reported by: (coypu sdf.org) admbugs: 857 MFC after: 3 days Reviewed by: adrian, markj Differential Revision: https://reviews.freebsd.org/D32340
|