[src/trunk]: src/sys/dev/pci Fix overflow.

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a5ce04d87dd1
branches:  trunk
changeset: 829065:a5ce04d87dd1
user:      maxv <maxv%NetBSD.org@localhost>
date:      Tue Jan 16 07:05:24 2018 +0000

description:
Fix overflow.

diffstat:

 sys/dev/pci/if_ipw.c |  13 +++++++------
 sys/dev/pci/if_iwi.c |  13 +++++++------
 sys/dev/pci/if_iwn.c |  13 +++++++------
 3 files changed, 21 insertions(+), 18 deletions(-)

diffs (108 lines):

diff -r 972afabceaa3 -r a5ce04d87dd1 sys/dev/pci/if_ipw.c
--- a/sys/dev/pci/if_ipw.c      Tue Jan 16 06:43:53 2018 +0000
+++ b/sys/dev/pci/if_ipw.c      Tue Jan 16 07:05:24 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ipw.c,v 1.66 2017/10/23 09:31:18 msaitoh Exp $      */
+/*     $NetBSD: if_ipw.c,v 1.67 2018/01/16 07:05:24 maxv Exp $ */
 /*     FreeBSD: src/sys/dev/ipw/if_ipw.c,v 1.15 2005/11/13 17:17:40 damien Exp         */
 
 /*-
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ipw.c,v 1.66 2017/10/23 09:31:18 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ipw.c,v 1.67 2018/01/16 07:05:24 maxv Exp $");
 
 /*-
  * Intel(R) PRO/Wireless 2100 MiniPCI driver
@@ -1001,12 +1001,13 @@
        efrm = mtod(m, uint8_t *) + m->m_len;
 
        frm += 12;      /* skip tstamp, bintval and capinfo fields */
-       while (frm < efrm) {
-               if (*frm == IEEE80211_ELEMID_DSPARMS)
+       while (frm + 2 < efrm) {
+               if (*frm == IEEE80211_ELEMID_DSPARMS) {
 #if IEEE80211_CHAN_MAX < 255
-               if (frm[2] <= IEEE80211_CHAN_MAX)
+                       if (frm[2] <= IEEE80211_CHAN_MAX)
 #endif
-                       ic->ic_curchan = &ic->ic_channels[frm[2]];
+                               ic->ic_curchan = &ic->ic_channels[frm[2]];
+               }
 
                frm += frm[1] + 2;
        }
diff -r 972afabceaa3 -r a5ce04d87dd1 sys/dev/pci/if_iwi.c
--- a/sys/dev/pci/if_iwi.c      Tue Jan 16 06:43:53 2018 +0000
+++ b/sys/dev/pci/if_iwi.c      Tue Jan 16 07:05:24 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_iwi.c,v 1.104 2017/10/23 09:28:13 msaitoh Exp $  */
+/*     $NetBSD: if_iwi.c,v 1.105 2018/01/16 07:05:24 maxv Exp $  */
 /*     $OpenBSD: if_iwi.c,v 1.111 2010/11/15 19:11:57 damien Exp $     */
 
 /*-
@@ -19,7 +19,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_iwi.c,v 1.104 2017/10/23 09:28:13 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_iwi.c,v 1.105 2018/01/16 07:05:24 maxv Exp $");
 
 /*-
  * Intel(R) PRO/Wireless 2200BG/2225BG/2915ABG driver
@@ -1126,12 +1126,13 @@
        efrm = mtod(m, uint8_t *) + m->m_len;
 
        frm += 12;      /* skip tstamp, bintval and capinfo fields */
-       while (frm < efrm) {
-               if (*frm == IEEE80211_ELEMID_DSPARMS)
+       while (frm + 2 < efrm) {
+               if (*frm == IEEE80211_ELEMID_DSPARMS) {
 #if IEEE80211_CHAN_MAX < 255
-               if (frm[2] <= IEEE80211_CHAN_MAX)
+                       if (frm[2] <= IEEE80211_CHAN_MAX)
 #endif
-                       ic->ic_curchan = &ic->ic_channels[frm[2]];
+                               ic->ic_curchan = &ic->ic_channels[frm[2]];
+               }
 
                frm += frm[1] + 2;
        }
diff -r 972afabceaa3 -r a5ce04d87dd1 sys/dev/pci/if_iwn.c
--- a/sys/dev/pci/if_iwn.c      Tue Jan 16 06:43:53 2018 +0000
+++ b/sys/dev/pci/if_iwn.c      Tue Jan 16 07:05:24 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_iwn.c,v 1.86 2017/10/23 09:31:18 msaitoh Exp $      */
+/*     $NetBSD: if_iwn.c,v 1.87 2018/01/16 07:05:24 maxv Exp $ */
 /*     $OpenBSD: if_iwn.c,v 1.135 2014/09/10 07:22:09 dcoppa Exp $     */
 
 /*-
@@ -22,7 +22,7 @@
  * adapters.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_iwn.c,v 1.86 2017/10/23 09:31:18 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_iwn.c,v 1.87 2018/01/16 07:05:24 maxv Exp $");
 
 #define IWN_USE_RBUF   /* Use local storage for RX */
 #undef IWN_HWCRYPTO    /* XXX does not even compile yet */
@@ -6607,12 +6607,13 @@
        efrm = mtod(m, uint8_t *) + m->m_len;
 
        frm += 12;      /* skip tstamp, bintval and capinfo fields */
-       while (frm < efrm) {
-               if (*frm == IEEE80211_ELEMID_DSPARMS)
+       while (frm + 2 < efrm) {
+               if (*frm == IEEE80211_ELEMID_DSPARMS) {
 #if IEEE80211_CHAN_MAX < 255
-               if (frm[2] <= IEEE80211_CHAN_MAX)
+                       if (frm[2] <= IEEE80211_CHAN_MAX)
 #endif
-                       ic->ic_curchan = &ic->ic_channels[frm[2]];
+                               ic->ic_curchan = &ic->ic_channels[frm[2]];
+               }
 
                frm += frm[1] + 2;
        }