git: b1f63c6ab7df - stable/14 - ipfilter: Avoid negative array indicies

The branch stable/14 has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=b1f63c6ab7df2f2f9febcd72e6af2e80fcc55197

commit b1f63c6ab7df2f2f9febcd72e6af2e80fcc55197
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2026-02-11 19:30:38 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-09-02 14:13:42 +0000

    ipfilter: Avoid negative array indicies
    
    Array indices must always be posive. We avoid this by making each index
    unsigned. This mitigates out-of-bounds reads and writes.
    
    Reported by:            Ilja Van Sprundel <ivansprundel@ioactive.com>
    Reviewed by:            glebius
    Differential revision:  https://reviews.freebsd.org/D55260
    
    (cherry picked from commit 3fdbd8a07a2dcb8fe3cec19fc59ef064453e4755)
---
 sys/netpfil/ipfilter/netinet/fil.c      | 4 ++--
 sys/netpfil/ipfilter/netinet/ip_fil.h   | 2 +-
 sys/netpfil/ipfilter/netinet/ip_state.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c
index da7b7a212035..409524aad55e 100644
--- a/sys/netpfil/ipfilter/netinet/fil.c
+++ b/sys/netpfil/ipfilter/netinet/fil.c
@@ -8550,7 +8550,7 @@ ipf_matcharray_load(ipf_main_softc_t *softc, caddr_t data, ipfobj_t *objp,
 int
 ipf_matcharray_verify(int *array, int arraysize)
 {
-	int i, nelem, maxidx;
+	u_int i, nelem, maxidx;
 	ipfexp_t *e;
 
 	nelem = arraysize / sizeof(*array);
@@ -8611,7 +8611,7 @@ ipf_matcharray_verify(int *array, int arraysize)
 static int
 ipf_fr_matcharray(fr_info_t *fin, int *array)
 {
-	int i, n, *x, rv, p;
+	u_int i, n, *x, rv, p;
 	ipfexp_t *e;
 
 	rv = 0;
diff --git a/sys/netpfil/ipfilter/netinet/ip_fil.h b/sys/netpfil/ipfilter/netinet/ip_fil.h
index 4bbb19c889bd..9dd84f045164 100644
--- a/sys/netpfil/ipfilter/netinet/ip_fil.h
+++ b/sys/netpfil/ipfilter/netinet/ip_fil.h
@@ -1475,7 +1475,7 @@ typedef struct ipfexp {
 	int		ipfe_cmd;
 	int		ipfe_not;
 	int		ipfe_narg;
-	int		ipfe_size;
+	u_int		ipfe_size;
 	int		ipfe_arg0[1];
 } ipfexp_t;
 
diff --git a/sys/netpfil/ipfilter/netinet/ip_state.c b/sys/netpfil/ipfilter/netinet/ip_state.c
index a22e19db15aa..7dba00ab5b19 100644
--- a/sys/netpfil/ipfilter/netinet/ip_state.c
+++ b/sys/netpfil/ipfilter/netinet/ip_state.c
@@ -4922,7 +4922,7 @@ ipf_state_matchflush(ipf_main_softc_t *softc, caddr_t data)
 static int
 ipf_state_matcharray(ipstate_t *state, int *array, u_long ticks)
 {
-	int i, n, *x, rv, p;
+	u_int i, n, *x, rv, p;
 	ipfexp_t *e;
 
 	rv = 0;