⬢ DragonFlyBSD Kernel Audit
DF-4817 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/iwm/if_iwm_phy_db.c
+++ b/sys/dev/netif/iwm/if_iwm_phy_db.c
@@ -382,6 +382,10 @@
 		txp_chg = (void *)phy_db->calib_ch_group_txp[i].data;
 		if (!txp_chg)
 			return 0xff;
+		/* Entry too small to contain the channel group header. */
+		if (phy_db->calib_ch_group_txp[i].size <
+		    sizeof(struct iwm_phy_db_chg_txp))
+			continue;
 		/*
 		 * Looking for the first channel group that its max channel is
 		 * higher then wanted channel.