in michael_mic, handle the case where the last 4 bytes cross a mbuf

boundary, fixes connection drops with WPA aka TKIP on dumb
wireless adapters (tested with wpi)
This commit is contained in:
drochner 2008-08-19 16:30:47 +00:00
parent 1e2fd53973
commit 9d0ccb1f06
1 changed files with 16 additions and 3 deletions

View File

@ -34,7 +34,7 @@
__FBSDID("$FreeBSD: src/sys/net80211/ieee80211_crypto_tkip.c,v 1.10 2005/08/08 18:46:35 sam Exp $");
#endif
#ifdef __NetBSD__
__KERNEL_RCSID(0, "$NetBSD: ieee80211_crypto_tkip.c,v 1.7 2006/11/16 01:33:40 christos Exp $");
__KERNEL_RCSID(0, "$NetBSD: ieee80211_crypto_tkip.c,v 1.8 2008/08/19 16:30:47 drochner Exp $");
#endif
/*
@ -829,11 +829,24 @@ michael_mic(struct tkip_ctx *ctx, const u8 *key,
while (space >= sizeof(uint32_t)) {
l ^= get_le32(data);
michael_block(l, r);
data += sizeof(uint32_t), space -= sizeof(uint32_t);
data += sizeof(uint32_t);
space -= sizeof(uint32_t);
data_len -= sizeof(uint32_t);
}
if (data_len < sizeof(uint32_t))
if (data_len < sizeof(uint32_t)) {
if (space < data_len) {
static uint8_t lastdata[3];
int i;
for (i = 0; i < space; i++)
lastdata[i] = data[i];
m = m->m_next;
data = mtod(m, const uint8_t *);
for (i = 0; i < data_len - space; i++)
lastdata[space + i] = data[i];
data = lastdata;
}
break;
}
m = m->m_next;
if (m == NULL) {
IASSERT(0, ("out of data, data_len %zu\n", data_len));