⬢ DragonFlyBSD Kernel Audit
DF-3464 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
--- a/sys/netproto/802_11/wlan/ieee80211_action.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_action.c	2026-10-26 03:32:28.582643565 +0000
@@ -84,28 +84,28 @@
 {
 	switch (cat) {
 	case IEEE80211_ACTION_CAT_BA:
-		if (act >= nitems(ba_send_action))
+		if (act < 0 || act >= nitems(ba_send_action))
 			break;
 		ba_send_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_HT:
-		if (act >= nitems(ht_send_action))
+		if (act < 0 || act >= nitems(ht_send_action))
 			break;
 		ht_send_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_SELF_PROT:
-		if (act >= nitems(meshpl_send_action))
+		if (act < 0 || act >= nitems(meshpl_send_action))
 			break;
 		meshpl_send_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_MESH:
-		if (act >= nitems(meshaction_send_action))
+		if (act < 0 || act >= nitems(meshaction_send_action))
 			break;
 		meshaction_send_action[act] = f;
 		return 0;
 		break;
 	case IEEE80211_ACTION_CAT_VENDOR:
-		if (act >= nitems(vendor_send_action))
+		if (act < 0 || act >= nitems(vendor_send_action))
 			break;
 		vendor_send_action[act] = f;
 		return 0;
@@ -126,23 +126,23 @@
 
 	switch (cat) {
 	case IEEE80211_ACTION_CAT_BA:
-		if (act < nitems(ba_send_action))
+		if (act >= 0 && act < nitems(ba_send_action))
 			f = ba_send_action[act];
 		break;
 	case IEEE80211_ACTION_CAT_HT:
-		if (act < nitems(ht_send_action))
+		if (act >= 0 && act < nitems(ht_send_action))
 			f = ht_send_action[act];
 		break;
 	case IEEE80211_ACTION_CAT_SELF_PROT:
-		if (act < nitems(meshpl_send_action))
+		if (act >= 0 && act < nitems(meshpl_send_action))
 			f = meshpl_send_action[act];
 		break;
 	case IEEE80211_ACTION_CAT_MESH:
-		if (act < nitems(meshaction_send_action))
+		if (act >= 0 && act < nitems(meshaction_send_action))
 			f = meshaction_send_action[act];
 		break;
 	case IEEE80211_ACTION_CAT_VENDOR:
-		if (act < nitems(vendor_send_action))
+		if (act >= 0 && act < nitems(vendor_send_action))
 			f = vendor_send_action[act];
 		break;
 	}
@@ -183,27 +183,27 @@
 {
 	switch (cat) {
 	case IEEE80211_ACTION_CAT_BA:
-		if (act >= nitems(ba_recv_action))
+		if (act < 0 || act >= nitems(ba_recv_action))
 			break;
 		ba_recv_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_HT:
-		if (act >= nitems(ht_recv_action))
+		if (act < 0 || act >= nitems(ht_recv_action))
 			break;
 		ht_recv_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_SELF_PROT:
-		if (act >= nitems(meshpl_recv_action))
+		if (act < 0 || act >= nitems(meshpl_recv_action))
 			break;
 		meshpl_recv_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_MESH:
-		if (act >= nitems(meshaction_recv_action))
+		if (act < 0 || act >= nitems(meshaction_recv_action))
 			break;
 		meshaction_recv_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_VENDOR:
-		if (act >= nitems(vendor_recv_action))
+		if (act < 0 || act >= nitems(vendor_recv_action))
 			break;
 		vendor_recv_action[act] = f;
 		return 0;