git: fc33bbb02450 - main - nd6: Fix the array size in union nd_opts
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 10 Sep 2026 09:28:35 UTC
The branch main has been updated by markj:
URL: https://cgit.FreeBSD.org/src/commit/?id=fc33bbb024502d2c90289ff4b62a8ec4d20df238
commit fc33bbb024502d2c90289ff4b62a8ec4d20df238
Author: Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-09-10 09:27:35 +0000
Commit: Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-09-10 09:27:35 +0000
nd6: Fix the array size in union nd_opts
ND_OPT_ROUTE_INFO is 24, so an access of that index is technically out
of bounds, though note that the per-option struct has an entry for this
option. Fix the array size to appease -fsanitize=array-bounds.
Reviewed by: pouria, glebius
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59392
---
sys/netinet6/nd6.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/netinet6/nd6.h b/sys/netinet6/nd6.h
index 8b00c2d4a339..d393353f6811 100644
--- a/sys/netinet6/nd6.h
+++ b/sys/netinet6/nd6.h
@@ -288,7 +288,7 @@ VNET_DECLARE(int, ip6_temp_regen_advance); /* seconds */
#define V_ip6_temp_regen_advance VNET(ip6_temp_regen_advance)
union nd_opts {
- struct nd_opt_hdr *nd_opt_array[24]; /* max = ND_OPT_ROUTE_INFO */
+ struct nd_opt_hdr *nd_opt_array[25]; /* max = ND_OPT_ROUTE_INFO */
struct {
struct nd_opt_hdr *zero;
struct nd_opt_hdr *src_lladdr;