ipfilter: Don't trust userland supplied iph_size

[cy]

Summary

ipf_htable_create() trusts a user-supplied iph_size from iphtable_t
and computes the allocation size as iph->iph_size * sizeof(*iph->iph_table)
without checking for integer overflow. A sufficiently large iph_size
causes the multiplication to wrap, resulting in an under-sized allocation
for the table pointer array. Subsequent code (e.g., in ipf_htent_insert())
can then write past the end of the allocated buffer, corrupting kernel
memory and causing DoS or potential privilege escalation.

Reported by: Ilja Van Sprundel <[e-mail]>
MFC after: 1 day

[markj]

sys/netpfil/ipfilter/netinet/ip_htable.c

367

Should we clamp the size to the maximum instead?

[cy]

sys/netpfil/ipfilter/netinet/ip_htable.c

367

Yes. To softh->ipf_htable_size_max. You're right the last test is extraneous.

But this patch is missing a part yet to be submitted.

[cy]

Fix the last of the issues Ilja Van Sprundel had identified in his
email regarding ip_htable.c.

Also address and fix a question by markj@.

[cy]

I really should have tested this before submitting the updated diff. I will test it now.

[cy]

This review is still active.

[markj]

sys/netpfil/ipfilter/netinet/ip_htable.c

369

374

I don't see why this cast is needed? iph_size is already a size_t.

[cy]

Removal of two size_t casts.