git: ae4f39464c61 - main - ng_parse: disallow negative length for malloc

The branch main has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=ae4f39464c61182c2bdfd3cc61594f8707b3daf0

commit ae4f39464c61182c2bdfd3cc61594f8707b3daf0
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-11-01 14:01:29 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-11-21 20:53:04 +0000

    ng_parse: disallow negative length for malloc
    
    This is an interim robustness improvement; further improvements as
    described in the PR and/or Phabricator review are still needed.
    
    PR:             267334
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D37229
---
 sys/netgraph/ng_parse.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/netgraph/ng_parse.c b/sys/netgraph/ng_parse.c
index e11070274484..1a1d9d8b3064 100644
--- a/sys/netgraph/ng_parse.c
+++ b/sys/netgraph/ng_parse.c
@@ -1207,6 +1207,8 @@ ng_parse_composite(const struct ng_parse_type *type, const char *s,
 	int align, len, blen, error = 0;
 
 	/* Initialize */
+	if (num < 0)
+		return (EINVAL);
 	foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO);
 	if (foff == NULL) {
 		error = ENOMEM;