Page MenuHomeFreeBSD

pf: Fix possible out-of-bounds write

Authored by kp on Feb 24 2016, 11:18 PM.
Referenced Files
Unknown Object (File)
Feb 23 2024, 1:52 PM
Unknown Object (File)
Feb 18 2024, 3:07 AM
Unknown Object (File)
Jan 4 2024, 4:15 PM
Unknown Object (File)
Jan 2 2024, 9:44 PM
Unknown Object (File)
Dec 20 2023, 1:16 AM
Unknown Object (File)
Nov 14 2023, 1:14 AM
Unknown Object (File)
Nov 13 2023, 12:25 PM
Unknown Object (File)
Nov 8 2023, 9:36 PM
"Like" token, awarded by


In the DIOCRSETADDRS ioctl() handler we allocate a table for struct pfr_addrs,
which is processed in pfr_set_addrs(). At the users request we also provide
feedback on the deleted addresses, by storing them after the new list
('bcopy(&ad, addr + size + i, sizeof(ad));' in pfr_set_addrs()).

This means we write outside the bounds of the buffer we've just allocated.
We need to look at pfrio_size2 instead (i.e. the size the user reserved for our
feedback). That'd allow a malicious user to specify a smaller pfrio_size2 than
pfrio_size though, in which case we'd still read outside of the allocated
buffer. Instead we allocate the largest of the two values.

Reported By: Paul J Murphy <>

Diff Detail

rS FreeBSD src repository - subversion
Lint Not Applicable
Tests Not Applicable

Event Timeline

kp retitled this revision from to pf: Fix possible out-of-bounds write.
kp updated this object.
kp edited the test plan for this revision. (Show Details)
kp set the repository for this revision to rS FreeBSD src repository - subversion.

Looks good to me. When backported to releng/10.2, it fixes bug #192677 for loading large blacklists into spamd.

This revision was automatically updated to reflect the committed changes.