Page MenuHomeFreeBSD
Files F148008069

D53286.diff
No OneTemporary
Actions

D53286.diff
View Options

diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c
--- a/sbin/ipf/libipf/interror.c
+++ b/sbin/ipf/libipf/interror.c
@@ -228,6 +228,8 @@
{ 30024, "object size incorrect for hash table" },
{ 30025, "hash table size must be at least 1"},
{ 30026, "cannot allocate memory for hash table context" },
+ { 30027, "hash table larger than maximum allowed" },
+ { 30028, "hash table multiplication overflow" },
/* -------------------------------------------------------------------------- */
{ 40001, "invalid minor device number for log read" },
{ 40002, "read size too small" },
diff --git a/sys/netpfil/ipfilter/netinet/ip_htable.c b/sys/netpfil/ipfilter/netinet/ip_htable.c
--- a/sys/netpfil/ipfilter/netinet/ip_htable.c
+++ b/sys/netpfil/ipfilter/netinet/ip_htable.c
@@ -361,6 +361,15 @@
iph->iph_name[sizeof(iph->iph_name) - 1] = '\0';
}
+ if ((iph->iph_size == 0) ||
+ (iph->iph_size > softh->ipf_htable_size_max)) {
+ IPFERROR(30027);
+ return (EINVAL);
+ }
+ if (iph->iph_size > ( SIZE_MAX / sizeof(*iph->iph_table))) {
+ IPFERROR(30028);
+ return (EINVAL);
+ }
KMALLOCS(iph->iph_table, iphtent_t **,
iph->iph_size * sizeof(*iph->iph_table));
if (iph->iph_table == NULL) {

File Metadata

Mime Type
text/plain
Expires
Mon, Mar 16, 4:13 AM (2 h, 45 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29752773
Default Alt Text
D53286.diff (1 KB)

Event Timeline