[src/trunk]: src/usr.sbin/btpand check number of filters received against max...

[plunky <plunky%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0fa081824608
branches:  trunk
changeset: 761834:0fa081824608
user:      plunky <plunky%NetBSD.org@localhost>
date:      Tue Feb 08 21:43:45 2011 +0000

description:
check number of filters received against max possible

diffstat:

 usr.sbin/btpand/bnep.c |  12 ++++++++++--
 usr.sbin/btpand/bnep.h |   5 ++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diffs (59 lines):

diff -r 7e1ff0c32db2 -r 0fa081824608 usr.sbin/btpand/bnep.c
--- a/usr.sbin/btpand/bnep.c    Tue Feb 08 20:55:51 2011 +0000
+++ b/usr.sbin/btpand/bnep.c    Tue Feb 08 21:43:45 2011 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bnep.c,v 1.9 2011/01/27 12:19:48 plunky Exp $  */
+/*     $NetBSD: bnep.c,v 1.10 2011/02/08 21:43:45 plunky Exp $ */
 
 /*-
  * Copyright (c) 2008 Iain Hibbert
@@ -26,7 +26,7 @@
  */
 
 #include <sys/cdefs.h>
-__RCSID("$NetBSD: bnep.c,v 1.9 2011/01/27 12:19:48 plunky Exp $");
+__RCSID("$NetBSD: bnep.c,v 1.10 2011/02/08 21:43:45 plunky Exp $");
 
 #include <bluetooth.h>
 #include <sdp.h>
@@ -429,6 +429,10 @@
        }
 
        nf = len / 4;
+       if (nf > BNEP_MAX_NET_TYPE_FILTERS) {
+               rsp = BNEP_FILTER_TOO_MANY_FILTERS;
+               goto done;
+       }
        pf = malloc(nf * sizeof(pfilter_t));
        if (pf == NULL) {
                rsp = BNEP_FILTER_TOO_MANY_FILTERS;
@@ -511,6 +515,10 @@
        }
 
        nf = len / (ETHER_ADDR_LEN * 2);
+       if (nf > BNEP_MAX_MULTI_ADDR_FILTERS) {
+               rsp = BNEP_FILTER_TOO_MANY_FILTERS;
+               goto done;
+       }
        mf = malloc(nf * sizeof(mfilter_t));
        if (mf == NULL) {
                rsp = BNEP_FILTER_TOO_MANY_FILTERS;
diff -r 7e1ff0c32db2 -r 0fa081824608 usr.sbin/btpand/bnep.h
--- a/usr.sbin/btpand/bnep.h    Tue Feb 08 20:55:51 2011 +0000
+++ b/usr.sbin/btpand/bnep.h    Tue Feb 08 21:43:45 2011 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bnep.h,v 1.1 2008/08/17 13:20:57 plunky Exp $  */
+/*     $NetBSD: bnep.h,v 1.2 2011/02/08 21:43:45 plunky Exp $  */
 
 /*-
  * Copyright (c) 2008 Iain Hibbert
@@ -36,6 +36,9 @@
 #define        BNEP_TYPE(x)            ((x) & 0x7f)
 #define BNEP_TYPE_EXT(x)       (((x) & BNEP_EXT) == BNEP_EXT)
 
+#define BNEP_MAX_NET_TYPE_FILTERS      421
+#define BNEP_MAX_MULTI_ADDR_FILTERS    120
+
 /* BNEP packet types */
 #define        BNEP_GENERAL_ETHERNET                   0x00
 #define        BNEP_CONTROL                            0x01