diff options
author | Felix Fietkau <nbd@openwrt.org> | 2010-01-24 23:39:00 +0000 |
---|---|---|
committer | Felix Fietkau <nbd@openwrt.org> | 2010-01-24 23:39:00 +0000 |
commit | 660874f45ecf5fd3dc19dd11e2e2006958db3467 (patch) | |
tree | 8178c6961d24310356875e5880d58d72f157e2b5 /package/madwifi/patches/370-wdsvap.patch | |
parent | ab82f72a297955dc01051bc61ffff4e06fd1e1f0 (diff) | |
download | master-187ad058-660874f45ecf5fd3dc19dd11e2e2006958db3467.tar.gz master-187ad058-660874f45ecf5fd3dc19dd11e2e2006958db3467.tar.bz2 master-187ad058-660874f45ecf5fd3dc19dd11e2e2006958db3467.zip |
madwifi: fix some potential null pointer derefs with wds
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@19322 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/madwifi/patches/370-wdsvap.patch')
-rw-r--r-- | package/madwifi/patches/370-wdsvap.patch | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/package/madwifi/patches/370-wdsvap.patch b/package/madwifi/patches/370-wdsvap.patch index 9da13a6c5c..e507afb25d 100644 --- a/package/madwifi/patches/370-wdsvap.patch +++ b/package/madwifi/patches/370-wdsvap.patch @@ -794,7 +794,7 @@ vap->iv_stats.is_rx_mgtdiscard++; return; } -@@ -3471,13 +3519,54 @@ ieee80211_recv_mgmt(struct ieee80211vap +@@ -3471,13 +3519,56 @@ ieee80211_recv_mgmt(struct ieee80211vap */ if (ic->ic_flags & IEEE80211_F_SCAN) { ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf); @@ -822,13 +822,15 @@ + if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) { + if (avp->iv_state != IEEE80211_S_RUN) + continue; ++ if (!avp->iv_wdsnode) ++ continue; + found = 1; + break; + } + } + if (found) + ni = ni_or_null = avp->iv_wdsnode; -+ } else if (vap->iv_opmode == IEEE80211_M_WDS) { ++ } else if ((vap->iv_opmode == IEEE80211_M_WDS) && vap->iv_wdsnode) { + found = 1; + ni = ni_or_null = vap->iv_wdsnode; + } @@ -854,7 +856,7 @@ } else { /* * Copy data from beacon to neighbor table. -@@ -3490,6 +3579,7 @@ ieee80211_recv_mgmt(struct ieee80211vap +@@ -3490,6 +3581,7 @@ ieee80211_recv_mgmt(struct ieee80211vap IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3); memcpy(ni->ni_tstamp.data, scan.tstamp, sizeof(ni->ni_tstamp)); |