system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-16 13:23:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

ath: fix possible memory disclosures in ioctl handlers

Browse source 
Apply the fix from r327499 to additional ioctl handlers.

Reported by:	Ilja van Sprundel <ivansprundel@ioactive.com>
MFC after:	1 week
MFC with:	r327499
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Ed Maste 2018-01-02 19:34:23 +00:00
parent 85f385b9aa
commit c24972459f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=327500
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys/dev/ath/if_ath_lna_div.c
View file

@ -189,7 +189,7 @@ ath_lna_div_ioctl(struct ath_softc *sc, struct ath_diag *ad)
* pointer for us to use below in reclaiming the buffer; * pointer for us to use below in reclaiming the buffer;
* may want to be more defensive. * may want to be more defensive.
*/ */
outdata = malloc(outsize, M_TEMP, M_NOWAIT); outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) { if (outdata == NULL) {
error = ENOMEM; error = ENOMEM;
goto bad; goto bad;
@ -198,6 +198,7 @@ ath_lna_div_ioctl(struct ath_softc *sc, struct ath_diag *ad)
switch (id) { switch (id) {
default: default:
error = EINVAL; error = EINVAL;
goto bad;
} }
if (outsize < ad->ad_out_size) if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize; ad->ad_out_size = outsize;

3
sys/dev/ath/if_ath_spectral.c
View file

@ -219,7 +219,7 @@ ath_ioctl_spectral(struct ath_softc *sc, struct ath_diag *ad)
* pointer for us to use below in reclaiming the buffer; * pointer for us to use below in reclaiming the buffer;
* may want to be more defensive. * may want to be more defensive.
*/ */
outdata = malloc(outsize, M_TEMP, M_NOWAIT); outdata = malloc(outsize, M_TEMP, M_NOWAIT | M_ZERO);
if (outdata == NULL) { if (outdata == NULL) {
error = ENOMEM; error = ENOMEM;
goto bad; goto bad;
@ -282,6 +282,7 @@ ath_ioctl_spectral(struct ath_softc *sc, struct ath_diag *ad)
break; break;
default: default:
error = EINVAL; error = EINVAL;
goto bad;
} }
if (outsize < ad->ad_out_size) if (outsize < ad->ad_out_size)
ad->ad_out_size = outsize; ad->ad_out_size = outsize;