Page MenuHomeFreeBSD
Files F176907441

D24539.1793600596.diff
No OneTemporary
Actions

Authored By
Unknown
Size
2 KB
Referenced Files
None
Subscribers
None

D24539.1793600596.diff
View Options

Index: sys/netpfil/pf/pf_ioctl.c
===================================================================
--- sys/netpfil/pf/pf_ioctl.c
+++ sys/netpfil/pf/pf_ioctl.c
@@ -3011,7 +3011,8 @@
case DIOCRGETTABLES: {
struct pfioc_table *io = (struct pfioc_table *)addr;
struct pfr_table *pfrts;
- size_t totlen, n;
+ size_t totlen;
+ int n;
if (io->pfrio_esize != sizeof(struct pfr_table)) {
error = ENODEV;
@@ -3019,6 +3020,11 @@
}
PF_RULES_RLOCK();
n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
+ if (n < 0) {
+ PF_RULES_RUNLOCK();
+ error = EINVAL;
+ break;
+ }
io->pfrio_size = min(io->pfrio_size, n);
totlen = io->pfrio_size * sizeof(struct pfr_table);
@@ -3042,7 +3048,8 @@
case DIOCRGETTSTATS: {
struct pfioc_table *io = (struct pfioc_table *)addr;
struct pfr_tstats *pfrtstats;
- size_t totlen, n;
+ size_t totlen;
+ int n;
if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
error = ENODEV;
@@ -3050,6 +3057,11 @@
}
PF_RULES_WLOCK();
n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
+ if (n < 0) {
+ PF_RULES_WUNLOCK();
+ error = EINVAL;
+ break;
+ }
io->pfrio_size = min(io->pfrio_size, n);
totlen = io->pfrio_size * sizeof(struct pfr_tstats);
@@ -3072,7 +3084,8 @@
case DIOCRCLRTSTATS: {
struct pfioc_table *io = (struct pfioc_table *)addr;
struct pfr_table *pfrts;
- size_t totlen, n;
+ size_t totlen;
+ int n;
if (io->pfrio_esize != sizeof(struct pfr_table)) {
error = ENODEV;
@@ -3081,6 +3094,11 @@
PF_RULES_WLOCK();
n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
+ if (n < 0) {
+ PF_RULES_WUNLOCK();
+ error = EINVAL;
+ break;
+ }
io->pfrio_size = min(io->pfrio_size, n);
totlen = io->pfrio_size * sizeof(struct pfr_table);
@@ -3107,7 +3125,8 @@
case DIOCRSETTFLAGS: {
struct pfioc_table *io = (struct pfioc_table *)addr;
struct pfr_table *pfrts;
- size_t totlen, n;
+ size_t totlen;
+ int n;
if (io->pfrio_esize != sizeof(struct pfr_table)) {
error = ENODEV;
@@ -3116,6 +3135,12 @@
PF_RULES_RLOCK();
n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
+ if (n < 0) {
+ PF_RULES_RUNLOCK();
+ error = EINVAL;
+ break;
+ }
+
io->pfrio_size = min(io->pfrio_size, n);
PF_RULES_RUNLOCK();

File Metadata

Mime Type
text/plain
Expires
Mon, Nov 2, 6:23 AM (2 h, 49 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41310133
Default Alt Text
D24539.1793600596.diff (2 KB)

Event Timeline