svn commit: r350864 - stable/12/sys/net

[George V. Neville-Neil]

Author: gnn
Date: Sun Aug 11 20:34:16 2019
New Revision: 350864
URL: https://svnweb.freebsd.org/changeset/base/350864

Log:
  MFC: 350557
  
  Properly validate arguments for route deletion
  
  Reported by: Liang Zhuo brightiup.zhuo at gmail.com

Modified:
  stable/12/sys/net/route.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/net/route.c
==============================================================================
--- stable/12/sys/net/route.c	Sun Aug 11 19:17:29 2019	(r350863)
+++ stable/12/sys/net/route.c	Sun Aug 11 20:34:16 2019	(r350864)
@@ -1553,6 +1553,8 @@ rtrequest1_fib(int req, struct rt_addrinfo *info, stru
 	switch (req) {
 	case RTM_DELETE:
 		if (netmask) {
+			if (dst->sa_len > sizeof(mdst))
+				return (EINVAL);
 			rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask);
 			dst = (struct sockaddr *)&mdst;
 		}