⬢ DragonFlyBSD Kernel Audit
DF-3578 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/iwn/if_iwn.c
+++ b/sys/dev/netif/iwn/if_iwn.c
@@ -5703,6 +5703,15 @@ iwn4965_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch,
 	for (c = 0; c < 2; c++) {
 		uint8_t power, gain, temp;
 		int maxchpwr, pwr, ridx, idx;
 
+		/* EEPROM sample channel numbers are unvalidated; equal
+		 * values would make interpolate() divide by zero (#DE). */
+		if (chans[1].num <= chans[0].num) {
+			device_printf(sc->sc_dev,
+			    "%s: invalid EEPROM channel samples %u/%u\n",
+			    __func__, chans[0].num, chans[1].num);
+			return EINVAL;
+		}
+
 		power = interpolate(chan,
 		    chans[0].num, chans[0].samples[c][1].power,
 		    chans[1].num, chans[1].samples[c][1].power, 1);