DragonFlyBSD Kernel Audit
DF-0421 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
--- a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
+++ b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
@@ -1752,27 +1752,28 @@
 	 * should not happen)
 	 */
 
-	if (m->m_pkthdr.len < 4)
-		panic("HCI frame size is too small! pktlen=%d\n",
-			m->m_pkthdr.len);
+	if (m->m_pkthdr.len < 4) {
+		NG_FREE_M(m);
+		break;
+	}
 
 	/* Process HCI frame */
 	switch (*mtod(m, uint8_t *)) {	/* XXX call m_pullup ? */
 	case NG_HCI_CMD_PKT:
-		if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE)
-			panic("HCI command frame size is too big! " \
-				"buffer size=%zd, packet len=%d\n",
-				UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len);
+		if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE) {
+			NG_FREE_M(m);
+			break;
+		}
 
 		q = &sc->sc_cmdq;
 		action = UBT_FLAG_T_START_CTRL;
 		break;
 
 	case NG_HCI_ACL_DATA_PKT:
-		if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE)
-			panic("ACL data frame size is too big! " \
-				"buffer size=%d, packet len=%d\n",
-				UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len);
+		if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE) {
+			NG_FREE_M(m);
+			break;
+		}
 
 		q = &sc->sc_aclq;
 		action = UBT_FLAG_T_START_BULK;