net80211: validate Mesh ID length in ieee80211_parse_beacon

Reported by:	m00nbsd working with Trend Micro Zero Day Initiative

This commit is contained in:

Bjoern A. Zeeb

2022-04-05 22:58:28 +00:00

committed by

Ed Maste

parent b0aa20bec5

commit fb8c87b4f3

1 changed files with 6 additions and 0 deletions

									
										sys/net80211/ieee80211_input.c
									
		+6
		
												View File
												
					@@ -742,6 +742,12 @@ ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m,

							IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),

							IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),

							    scan->status |= IEEE80211_BPARSE_CSA_INVALID);

							    scan->status |= IEEE80211_BPARSE_CSA_INVALID);

						}

						}

					#ifdef IEEE80211_SUPPORT_MESH

						if (scan->meshid != NULL) {

							IEEE80211_VERIFY_ELEMENT(scan->meshid, IEEE80211_MESHID_LEN,

							    scan->status |= IEEE80211_BPARSE_RATES_INVALID);

						}

					#endif

						/*

						/*

						 * Process HT ie's.  This is complicated by our

						 * Process HT ie's.  This is complicated by our

						 * accepting both the standard ie's and the pre-draft

						 * accepting both the standard ie's and the pre-draft