Page MenuHomeFreeBSD
Differential D57441

ping6: fix outpack overflow in pattern fill loop
ClosedPublic
Actions

Authored by oshogbo on Jun 4 2026, 3:00 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Jul 20, 1:34 PM
Unknown Object (File)
Sun, Jul 19, 2:43 PM
Unknown Object (File)
Sun, Jul 19, 9:36 AM
Unknown Object (File)
Sun, Jul 19, 8:53 AM
Unknown Object (File)
Sat, Jul 18, 3:15 AM
Unknown Object (File)
Wed, Jul 15, 7:25 AM
Unknown Object (File)
Wed, Jul 15, 7:25 AM
Unknown Object (File)
Fri, Jul 3, 3:33 AM
View All 53 Files
Subscribers
des
imp
jhb

Details

Reviewers
markj
des
Group Reviewers
secteam
Commits
rGe15be258bbf2: ping6: fix outpack overflow in pattern fill loop
Summary

The fill loop was bounded by packlen, which is sized for the receive
buffer (datalen + IP6LEN + ICMP6ECHOLEN + EXTRA), not for outpack.
With large datalen the loop wrote past outpack[MAXPACKETLEN].

Bound it to the actual data area in outpack instead.

Reported by: Oculytic

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 73735
Build 70618: arc lint + arc unit

Event Timeline

oshogbo created this revision.Jun 4 2026, 3:00 PM
oshogbo held this revision as a draft.
Herald added a subscriber: imp. · View Herald TranscriptJun 4 2026, 3:00 PM
Harbormaster completed remote builds in B73669: Diff 179213.Jun 4 2026, 3:00 PM
oshogbo published this revision for review.Jun 4 2026, 3:01 PM
oshogbo changed the visibility from "Public (No Login Required)" to "secteam (Project)".
oshogbo changed the edit policy from "All Users" to "secteam (Project)".
oshogbo added a reviewer: markj.
oshogbo added a reviewer: secteam.
markj accepted this revision as: markj.Jun 4 2026, 4:29 PM

There is a ton of cleanup that could be done in this file. We should also ensure that casper services are created after ping drops its privileges...

sbin/ping/ping6.c
766–767
This revision is now accepted and ready to land.Jun 4 2026, 4:29 PM
emaste added a subscriber: jhb.Jun 5 2026, 3:11 PM
des requested changes to this revision.Jun 5 2026, 3:13 PM
des added a subscriber: des.
des added inline comments.
sbin/ping/ping6.c
241

should take a size

765–766

braces please

766–767
This revision now requires changes to proceed.Jun 5 2026, 3:13 PM
oshogbo updated this revision to Diff 179375.Jun 8 2026, 7:24 AM

Address review from des

Harbormaster completed remote builds in B73735: Diff 179375.Jun 8 2026, 7:24 AM
des added a comment.Jun 8 2026, 12:04 PM
In D57441#1317373, @oshogbo wrote:

Address review from des

You skipped the most important part. The filling loop is still incorrect.

oshogbo updated this revision to Diff 179547.Jun 10 2026, 8:32 AM
oshogbo marked 3 inline comments as done.

Fix the loop.

Yes you were right, sorry about that.

Harbormaster completed remote builds in B73792: Diff 179547.Jun 10 2026, 8:32 AM
des accepted this revision.Jun 10 2026, 5:10 PM
This revision is now accepted and ready to land.Jun 10 2026, 5:10 PM
markj accepted this revision.Jun 12 2026, 12:16 AM
oshogbo changed the visibility from "secteam (Project)" to "Public (No Login Required)".Jun 16 2026, 5:04 PM
Closed by commit rGe15be258bbf2: ping6: fix outpack overflow in pattern fill loop (authored by oshogbo). · Explain WhyJun 16 2026, 5:08 PM
This revision was automatically updated to reflect the committed changes.
oshogbo added a commit: rGe15be258bbf2: ping6: fix outpack overflow in pattern fill loop.

Revision Contents
Changeset List

PathSize
sbin/
ping/
23 lines

Diff 179375

View Options

sbin/ping/ping6.c

Loading...