Page MenuHomeFreeBSD
Files F151145452

D53286.id164824.diff
No OneTemporary
Actions

D53286.id164824.diff
View Options

diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c
--- a/sbin/ipf/libipf/interror.c
+++ b/sbin/ipf/libipf/interror.c
@@ -228,6 +228,7 @@
{ 30024, "object size incorrect for hash table" },
{ 30025, "hash table size must be at least 1"},
{ 30026, "cannot allocate memory for hash table context" },
+ { 30027, "hash table larger than maximum allowed" },
/* -------------------------------------------------------------------------- */
{ 40001, "invalid minor device number for log read" },
{ 40002, "read size too small" },
diff --git a/sys/netpfil/ipfilter/netinet/ip_htable.c b/sys/netpfil/ipfilter/netinet/ip_htable.c
--- a/sys/netpfil/ipfilter/netinet/ip_htable.c
+++ b/sys/netpfil/ipfilter/netinet/ip_htable.c
@@ -361,6 +361,12 @@
iph->iph_name[sizeof(iph->iph_name) - 1] = '\0';
}
+ if ((iph->iph_size == 0) ||
+ (iph->iph_size > softh->ipf_htable_size_max) ||
+ (iph->iph_size > SIZE_MAX / sizeof(*iph->iph_table))) {
+ IPFERROR(30027);
+ return (EINVAL);
+ }
KMALLOCS(iph->iph_table, iphtent_t **,
iph->iph_size * sizeof(*iph->iph_table));
if (iph->iph_table == NULL) {

File Metadata

Mime Type
text/plain
Expires
Tue, Apr 7, 9:54 AM (5 h, 46 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
31024385
Default Alt Text
D53286.id164824.diff (1 KB)

Event Timeline