Page MenuHomeFreeBSD
Files F177476074

D61440.1794516431.diff
No OneTemporary
Actions

Authored By
Unknown
Size
4 KB
Referenced Files
None
Subscribers
None

D61440.1794516431.diff
View Options

diff --git a/sys/netpfil/ipfw/ip_dummynet.c b/sys/netpfil/ipfw/ip_dummynet.c
--- a/sys/netpfil/ipfw/ip_dummynet.c
+++ b/sys/netpfil/ipfw/ip_dummynet.c
@@ -2100,6 +2100,10 @@
err = ENOMEM;
break;
}
+ if (o.len < sizeof(dn->link)) {
+ err = EINVAL;
+ break;
+ }
memcpy(&dn->link, (char *)p + off, sizeof(dn->link));
err = config_link(&dn->link, arg);
break;
@@ -2110,6 +2114,10 @@
err = ENOMEM;
break;
}
+ if (o.len < sizeof(dn->profile)) {
+ err = EINVAL;
+ break;
+ }
memcpy(&dn->profile, (char *)p + off,
sizeof(dn->profile));
err = config_profile(&dn->profile, arg);
@@ -2121,6 +2129,10 @@
err = ENOMEM;
break;
}
+ if (o.len < sizeof(dn->sched)) {
+ err = EINVAL;
+ break;
+ }
memcpy(&dn->sched, (char *)p + off,
sizeof(dn->sched));
err = config_sched(&dn->sched, arg);
@@ -2132,6 +2144,10 @@
err = ENOMEM;
break;
}
+ if (o.len < sizeof(dn->fs)) {
+ err = EINVAL;
+ break;
+ }
memcpy(&dn->fs, (char *)p + off, sizeof(dn->fs));
err = (NULL == config_fs(&dn->fs, arg, 0));
break;
diff --git a/tests/sys/netpfil/common/Makefile b/tests/sys/netpfil/common/Makefile
--- a/tests/sys/netpfil/common/Makefile
+++ b/tests/sys/netpfil/common/Makefile
@@ -4,6 +4,8 @@
BINDIR= ${TESTSDIR}
+ATF_TESTS_C+= dummynet_config_test
+
ATF_TESTS_SH+= \
dummynet \
pass_block \
diff --git a/tests/sys/netpfil/common/dummynet_config_test.c b/tests/sys/netpfil/common/dummynet_config_test.c
new file mode 100644
--- /dev/null
+++ b/tests/sys/netpfil/common/dummynet_config_test.c
@@ -0,0 +1,96 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2026 Osvaldo Janeri Filho <ojanerif@amd.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <netinet/ip_fw.h>
+#include <netinet/ip_dummynet.h>
+
+#include <errno.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <atf-c.h>
+
+/*
+ * do_config() validates that each command's declared length fits in the
+ * supplied buffer, but the DN_LINK, DN_PROFILE, DN_SCH and DN_FS cases
+ * copy a fixed sizeof(struct) that is larger than struct dn_id. A command
+ * whose oid.len is only sizeof(struct dn_id) must be rejected rather than
+ * read beyond the buffer.
+ */
+static void
+check_short_object(uint8_t type)
+{
+ struct dn_id o;
+ int s, rv;
+
+ s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
+ ATF_REQUIRE_MSG(s >= 0, "raw socket: %s", strerror(errno));
+
+ memset(&o, 0, sizeof(o));
+ o.len = sizeof(o);
+ o.type = type;
+ o.id = DN_API_VERSION;
+
+ rv = setsockopt(s, IPPROTO_IP, IP_DUMMYNET3, &o, sizeof(o));
+ ATF_CHECK_MSG(rv == -1 && errno == EINVAL,
+ "type %u: expected EINVAL, got rv=%d errno=%d", type, rv, errno);
+
+ close(s);
+}
+
+ATF_TC_WITHOUT_HEAD(dn_link_short);
+ATF_TC_BODY(dn_link_short, tc)
+{
+ check_short_object(DN_LINK);
+}
+
+ATF_TC_WITHOUT_HEAD(dn_profile_short);
+ATF_TC_BODY(dn_profile_short, tc)
+{
+ check_short_object(DN_PROFILE);
+}
+
+ATF_TC_WITHOUT_HEAD(dn_sch_short);
+ATF_TC_BODY(dn_sch_short, tc)
+{
+ check_short_object(DN_SCH);
+}
+
+ATF_TC_WITHOUT_HEAD(dn_fs_short);
+ATF_TC_BODY(dn_fs_short, tc)
+{
+ check_short_object(DN_FS);
+}
+
+ATF_TP_ADD_TCS(tp)
+{
+ ATF_TP_ADD_TC(tp, dn_link_short);
+ ATF_TP_ADD_TC(tp, dn_profile_short);
+ ATF_TP_ADD_TC(tp, dn_sch_short);
+ ATF_TP_ADD_TC(tp, dn_fs_short);
+
+ return (atf_no_error());
+}

File Metadata

Mime Type
text/plain
Expires
Thu, Nov 12, 8:47 PM (5 h, 47 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41683641
Default Alt Text
D61440.1794516431.diff (4 KB)

Event Timeline