⬢ DragonFlyBSD Kernel Audit
DF-3342 / fix.diff
← back to finding ↓ download raw
--- a/sys/netproto/802_11/wlan/ieee80211_sta.c
+++ b/sys/netproto/802_11/wlan/ieee80211_sta.c
@@ -641,6 +641,11 @@ ieee80211_sta_input(...)
 		if ( IEEE80211_HAS_SEQ(type, subtype) &&
 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
+			/* DF-3342: pre-dispatch seq/QoS reads need the full
+			 * header present (mirror of DF-3325) */
+			if (m->m_pkthdr.len <
+			    (IEEE80211_QOS_HAS_SEQ(wh) ?
+			     sizeof(struct ieee80211_qosframe) :
+			     sizeof(struct ieee80211_frame)))
+				goto out;
 			uint8_t tid = ieee80211_gettid(wh);