Page MenuHomeFreeBSD

ipfilter: Interface name must not extend beyond end of buffer
Needs ReviewPublic

Authored by cy on Thu, Jan 8, 8:59 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Jan 26, 10:59 AM
Unknown Object (File)
Fri, Jan 23, 4:53 PM
Unknown Object (File)
Tue, Jan 20, 3:21 PM
Unknown Object (File)
Tue, Jan 20, 12:01 PM
Unknown Object (File)
Tue, Jan 20, 3:17 AM
Unknown Object (File)
Mon, Jan 19, 5:21 PM
Unknown Object (File)
Sun, Jan 18, 2:29 AM
Unknown Object (File)
Wed, Jan 14, 9:41 AM

Details

Summary

sifpidx (an interface name) cannot extend beyond the end of the
fr_names buffer.
We do the validation for fr_sifpidx here because it is a union that
contains an offset only when fr_sifpidx points to an interface name,
an offset into fr_names. The union is an offset into fr_names in this
case only.

Note that sifpidx is only used in ipf_sync() which implments ipf -y.

Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after: 1 week

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 69739
Build 66622: arc lint + arc unit