madwifi: fix some potential null pointer derefs with wds

[openwrt/svn-archive/archive.git] / package / madwifi / patches / 370-wdsvap.patch

diff --git a/package/madwifi/patches/370-wdsvap.patch b/package/madwifi/patches/370-wdsvap.patch
index 9da13a6c5c7bdb2aea3f49a624eb523fcd4cebf7..e507afb25d65bae7e67ff24530c42dd6d5e75220 100644 (file)
--- a/package/madwifi/patches/370-wdsvap.patch
+++ b/package/madwifi/patches/370-wdsvap.patch
@@ -794,7 +794,7 @@
                        vap->iv_stats.is_rx_mgtdiscard++;
                        return;
                }
-@@ -3471,13 +3519,54 @@ ieee80211_recv_mgmt(struct ieee80211vap 
+@@ -3471,13 +3519,56 @@ ieee80211_recv_mgmt(struct ieee80211vap 
                 */
                if (ic->ic_flags & IEEE80211_F_SCAN) {
                        ieee80211_add_scan(vap, &scan, wh, subtype, rssi, rtsf);
@@ -822,13 +822,15 @@
 +                                      if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
 +                                              if (avp->iv_state != IEEE80211_S_RUN)
 +                                                      continue;
++                                              if (!avp->iv_wdsnode)
++                                                      continue;
 +                                              found = 1;
 +                                              break;
 +                                      }
 +                              }
 +                              if (found)
 +                                      ni = ni_or_null = avp->iv_wdsnode;
-+                      } else if (vap->iv_opmode == IEEE80211_M_WDS) {
++                      } else if ((vap->iv_opmode == IEEE80211_M_WDS) && vap->iv_wdsnode) {
 +                              found = 1;
 +                              ni = ni_or_null = vap->iv_wdsnode;
 +                      }
@@ -854,7 +856,7 @@
                        } else {
                                /*
                                 * Copy data from beacon to neighbor table.
-@@ -3490,6 +3579,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
+@@ -3490,6 +3581,7 @@ ieee80211_recv_mgmt(struct ieee80211vap 
                                IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
                                memcpy(ni->ni_tstamp.data, scan.tstamp,
                                        sizeof(ni->ni_tstamp));