Page MenuHomeFreeBSD
Files F164774687

D53475.id165452.diff
No OneTemporary
Actions

D53475.id165452.diff
View Options

diff --git a/sbin/ipf/libipf/interror.c b/sbin/ipf/libipf/interror.c
--- a/sbin/ipf/libipf/interror.c
+++ b/sbin/ipf/libipf/interror.c
@@ -177,6 +177,9 @@
{ 149, "object size validation failed for kernel copyout" },
{ 150, "error copying data out for kernel copyout" },
{ 151, "version mismatch for kernel copyout" },
+ { 152, "fr_names offset is wrapped negative" },
+ { 153, "fr_names larger than fr_namelen" },
+ { 154, "frentry larger than fr_size" },
/* -------------------------------------------------------------------------- */
{ 10001, "could not find token for auth iterator" },
{ 10002, "write permissions require to add/remove auth rule" },
diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c
--- a/sys/netpfil/ipfilter/netinet/fil.c
+++ b/sys/netpfil/ipfilter/netinet/fil.c
@@ -4408,7 +4408,9 @@
void *ptr, *uptr;
u_int *p, *pp;
frgroup_t *fg;
- char *group;
+ char *group, *name;
+ size_t v_fr_size, element_size;
+ int rem_namelen;
ptr = NULL;
fg = NULL;
@@ -4465,6 +4467,46 @@
goto donenolock;
}
+ /*
+ * Validate the incoming frentry_t.
+ */
+#define VFY_FR_NAME(_a, _b) \
+ if (_a->_b != -1) { \
+ if (_a->_b < -1) { \
+ IPFERROR(152); \
+ error = EINVAL; \
+ goto donenolock; \
+ } \
+ name = FR_NAME(_a, _b); \
+ element_size = strnlen(name, rem_namelen) + 1; \
+ v_fr_size += element_size; \
+ rem_namelen -= element_size; \
+ if (rem_namelen < 0 || v_fr_size > fp->fr_size) { \
+ IPFERROR(153); \
+ error = EINVAL; \
+ goto donenolock; \
+ } \
+ }
+
+ v_fr_size = sizeof(*fp);
+ rem_namelen = fp->fr_namelen;
+ VFY_FR_NAME(fp, fr_comment);
+ VFY_FR_NAME(fp, fr_group);
+ VFY_FR_NAME(fp, fr_grhead);
+ VFY_FR_NAME(fp, fr_grhead);
+ VFY_FR_NAME(fp, fr_ifnames[0]);
+ VFY_FR_NAME(fp, fr_ifnames[1]);
+ VFY_FR_NAME(fp, fr_ifnames[2]);
+ VFY_FR_NAME(fp, fr_ifnames[3]);
+ VFY_FR_NAME(fp, fr_tif.fd_name);
+ VFY_FR_NAME(fp, fr_rif.fd_name);
+ VFY_FR_NAME(fp, fr_dif.fd_name);
+ if (v_fr_size > fp->fr_size) {
+ IPFERROR(154);
+ error = EINVAL;
+ goto donenolock;
+ }
+
family = fp->fr_family;
uptr = fp->fr_data;

File Metadata

Mime Type
text/plain
Expires
Tue, Aug 4, 10:24 PM (48 m, 29 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35973899
Default Alt Text
D53475.id165452.diff (2 KB)

Event Timeline