svn commit: r313986 - head/sys/net80211

[Adrian Chadd]

Author: adrian
Date: Mon Feb 20 04:04:59 2017
New Revision: 313986
URL: https://svnweb.freebsd.org/changeset/base/313986

Log:
  [net80211] validate VHT IEs.

Modified:
  head/sys/net80211/ieee80211_hostap.c

Modified: head/sys/net80211/ieee80211_hostap.c
==============================================================================
--- head/sys/net80211/ieee80211_hostap.c	Mon Feb 20 04:02:50 2017	(r313985)
+++ head/sys/net80211/ieee80211_hostap.c	Mon Feb 20 04:04:59 2017	(r313986)
@@ -2101,7 +2101,17 @@ hostap_recv_mgmt(struct ieee80211_node *
 			     return);		/* XXX just NULL out? */
 		}
 
-		/* XXX validate VHT IEs */
+		/* Validate VHT IEs */
+		if (vhtcap != NULL) {
+			IEEE80211_VERIFY_LENGTH(vhtcap[1],
+			    sizeof(struct ieee80211_ie_vhtcap) - 2,
+			    return);
+		}
+		if (vhtinfo != NULL) {
+			IEEE80211_VERIFY_LENGTH(vhtinfo[1],
+			    sizeof(struct ieee80211_ie_vht_operation) - 2,
+			    return);
+		}
 
 		if ((vap->iv_flags & IEEE80211_F_WPA) &&
 		    !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))