svn commit: r350557 - head/sys/net

[George V. Neville-Neil]

Author: gnn
Date: Sat Aug  3 14:42:07 2019
New Revision: 350557
URL: https://svnweb.freebsd.org/changeset/base/350557

Log:
  Properly validte arguments for route deletion
  
  Reported by: Liang Zhuo brightiup.zhuo at gmail.com
  MFC after:	1 week

Modified:
  head/sys/net/route.c

Modified: head/sys/net/route.c
==============================================================================
--- head/sys/net/route.c	Sat Aug  3 13:53:14 2019	(r350556)
+++ head/sys/net/route.c	Sat Aug  3 14:42:07 2019	(r350557)
@@ -1590,6 +1590,8 @@ rtrequest1_fib(int req, struct rt_addrinfo *info, stru
 	switch (req) {
 	case RTM_DELETE:
 		if (netmask) {
+			if (dst->sa_len > sizeof(mdst))
+				return (EINVAL);
 			rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask);
 			dst = (struct sockaddr *)&mdst;
 		}