Parcourir la source

l2_packet_ndis: Fix overlapped write not to corrupt stack

When using overlapped write, we must have the provided memory
areas available during the operation and cannot just use stack
unless we wait for the completion within the function. In the case
of TX here, we can easily wait for the completion since it is likely
to happen immediately. In addition, this provides more reliable
success/failure return value for l2_packet_send(). [Bug 328]
Jouni Malinen il y a 14 ans
Parent
commit
f4e5fd948a
1 fichiers modifiés avec 11 ajouts et 5 suppressions
  1. 11 5
      src/l2_packet/l2_packet_ndis.c

+ 11 - 5
src/l2_packet/l2_packet_ndis.c

@@ -137,11 +137,17 @@ int l2_packet_send(struct l2_packet_data *l2, const u8 *dst_addr, u16 proto,
 		DWORD err = GetLastError();
 		DWORD err = GetLastError();
 #ifndef _WIN32_WCE
 #ifndef _WIN32_WCE
 		if (err == ERROR_IO_PENDING) {
 		if (err == ERROR_IO_PENDING) {
-			/* For now, just assume that the packet will be sent in
-			 * time before the next write happens. This could be
-			 * cleaned up at some point to actually wait for
-			 * completion before starting new writes.
-			 */
+			wpa_printf(MSG_DEBUG, "L2(NDISUIO): Wait for pending "
+				   "write to complete");
+			res = GetOverlappedResult(
+				driver_ndis_get_ndisuio_handle(), &overlapped,
+				&written, TRUE);
+			if (!res) {
+				wpa_printf(MSG_DEBUG, "L2(NDISUIO): "
+					   "GetOverlappedResult failed: %d",
+					   (int) GetLastError());
+				return -1;
+			}
 			return 0;
 			return 0;
 		}
 		}
 #endif /* _WIN32_WCE */
 #endif /* _WIN32_WCE */