git: c6b08de0e4c7 - main - ipfw: fix off-by-one error in bdel()

The branch main has been updated by ae:

URL: https://cgit.FreeBSD.org/src/commit/?id=c6b08de0e4c797929f4609d86395d494ac695c68

commit c6b08de0e4c797929f4609d86395d494ac695c68
Author:     Andrey V. Elsukov <ae@FreeBSD.org>
AuthorDate: 2026-10-28 11:13:53 +0000
Commit:     Andrey V. Elsukov <ae@FreeBSD.org>
CommitDate: 2026-10-28 11:13:53 +0000

    ipfw: fix off-by-one error in bdel()
    
    After deleting an item from a sorted array, bdel() moves the tail
    following it, but the size of the data to move was calculated with
    an off-by-one error, causing memmove() to read one element past the
    end of the array. This can happen when the table is full for ifidx
    or numarray algorithms.
    
    Obtained from:  Yandex LLC
    MFC after:      1 week
    Sponsored by:   Yandex LLC
---
 sys/netpfil/ipfw/ip_fw_table_algo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/netpfil/ipfw/ip_fw_table_algo.c b/sys/netpfil/ipfw/ip_fw_table_algo.c
index 515c420ed663..23642c657227 100644
--- a/sys/netpfil/ipfw/ip_fw_table_algo.c
+++ b/sys/netpfil/ipfw/ip_fw_table_algo.c
@@ -2063,7 +2063,7 @@ bdel(const void *key, void *base, size_t nmemb, size_t size,
 	if (item == NULL)
 		return (0);
 
-	sz = (caddr_t)base + nmemb * size - item;
+	sz = (caddr_t)base + nmemb * size - item - size;
 
 	if (sz > 0)
 		memmove(item, item + size, sz);