diff options
| author | Warner Losh <imp@FreeBSD.org> | 2002-04-04 22:22:31 +0000 |
|---|---|---|
| committer | Warner Losh <imp@FreeBSD.org> | 2002-04-04 22:22:31 +0000 |
| commit | 15ffbeb81deb2f725101dffa8f08449085856a5a (patch) | |
| tree | 295766446a5d8a6042c05c6ec9368273ed6acb84 | |
| parent | cdef1605aeab42f10372365934bf681b96269f68 (diff) | |
Notes
| -rw-r--r-- | sys/dev/wi/if_wi.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c index 7192b3769b38..47a6368a1963 100644 --- a/sys/dev/wi/if_wi.c +++ b/sys/dev/wi/if_wi.c @@ -1461,6 +1461,10 @@ wi_ioctl(ifp, command, data) error = copyin(ifr->ifr_data, &wreq, sizeof(wreq)); if (error) break; + if (wreq.wi_len > WI_MAX_DATALEN) { + error = EINVAL; + break; + } /* Don't show WEP keys to non-root users. */ if (wreq.wi_type == WI_RID_DEFLT_CRYPT_KEYS && suser(td)) break; @@ -1512,6 +1516,10 @@ wi_ioctl(ifp, command, data) error = copyin(ifr->ifr_data, &wreq, sizeof(wreq)); if (error) break; + if (wreq.wi_len > WI_MAX_DATALEN) { + error = EINVAL; + break; + } if (wreq.wi_type == WI_RID_IFACE_STATS) { error = EINVAL; break; |