Page MenuHomeFreeBSD

ipfilter: Prevent stack buffer overflow
ClosedPublic

Authored by des on Dec 12 2025, 4:25 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Jan 22, 10:50 PM
Unknown Object (File)
Thu, Jan 15, 6:47 PM
Unknown Object (File)
Wed, Jan 14, 11:18 AM
Unknown Object (File)
Thu, Jan 8, 3:32 PM
Unknown Object (File)
Thu, Jan 8, 12:11 AM
Unknown Object (File)
Tue, Jan 6, 3:06 PM
Unknown Object (File)
Wed, Dec 31, 3:34 AM
Unknown Object (File)
Dec 25 2025, 1:10 AM

Details

Summary

When copying ipfs data from user space, don't just check that the payload
length is nonzero, but also that it does not exceed the size of the stack
buffer we're copying it into.

While we're at it, use a union to create a buffer of the exact size we
need instead of guessing that 2048 will be enough (and not too much).

Finally, check the size of the payload once it gets to where it's used.

MFC after: 3 days

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable