From nobody Tue Sep 29 01:48:22 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hv1Kl72zrz6tBsy for ; Tue, 29 Sep 2026 01:48:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hv1Kl6Gzlz4kc6 for ; Tue, 29 Sep 2026 01:48:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790646507; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bLh0fI97K1qYh8PxiEz8h494lJ3VK0g4CkaEcx0ro0Y=; b=MOBNN7HEehSNV8V3ROQlEF5p/jR/iQpjAJNMQCuIHHomSh7vMZ/ERKcheaiP0MPIkONgGy 3XP6m80ERXulSPleqG7Y/aJjix75xDJiP57dL/QUSKgkPS0UoF+LsVyHCQZ8ACAGrhSP4N 8TmhfuKBOvL6VWkPtHVp3BHFDhDxpvnUXaLqzWX09zDW13/JKBaLv84BSh/ihC3aGn4HkW +BiTDSnaK4DE0z0bKqWuMzKvZpU74V0QouM+HAGSF82ozRME1jFep1BBNLUjZHs5HjDY0g WnoMxwEu1Wfn6xjf8mDmiNBoiNIsjGTcrvs5fvi4fF2mmubEvc1eGs6JAeErpA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1790646507; b=HznkOsJ9muPtECoXurCYLbXllEnkU/Bf7w7wJBSosXOLKxa3+GeT0EM3YbFbKzxuZvwne2 42N/csBrlpoxCOkRAUAc+jhGhM8rsJ7dYAwHGkay6KoP9Kp/8xSMVoZs2VJ8xQZMMgE+KI BvbPiOAh0Arom/SIDBpICxmEDoLHWpIJabEo8lhxOE0D9w+tiL2bDJAlvORbbr27HIp49A 3Ivydcwq8XBnAKdRj9E68l2It5+RsEj0tMRbhYyy5byY8w+utflflP4jCuW88EEpHBqlnl nEgzGTGK0X8m4GfyaQRiktJ+2odLq/33edb5aPjmCMVc1FtQP4yIYZFfPSCsrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1790646507; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bLh0fI97K1qYh8PxiEz8h494lJ3VK0g4CkaEcx0ro0Y=; b=Wrw0YXCKTku2PNmerYAK/jrst6lt7Hx5cDLP+sNG+xqibvicFJRoVLtvyjpODkR3KQWYST qpBGDuhAQawirok/DKcgS4b1eYjQdU+PC2Zb+ieq1J+h1eO5lStW31c3ki88+pqISmTCfO 7MsNqpTlPqaMyFqU1QrVHr0iNDcSiX7rgwe97a/gcsbTgKasYq0lneCrmFMVjfbFpo21HT xejLNCrYwPaULDjQ3M+7bx8GrqeMerAVP2KkNHMFQyU4gXG2MwE+IHw5i0jfdyaoYo/gr1 1Fw/k7RA0+/KQZQhW84+YasAZqV47uCxog/J4usKD4+xSWpGqLm1DP4ejSOHnA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hv1Kl4yNZzt4w for ; Tue, 29 Sep 2026 01:48:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 196f4 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 29 Sep 2026 01:48:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Maxim Konovalov Subject: git: da0067ded585 - stable/15 - ipfw: guard against NULL deref with clat/plat prefixes without length List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: maxim X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: da0067ded585fbf242fb15a7dbeb155130f1be6d Auto-Submitted: auto-generated Date: Tue, 29 Sep 2026 01:48:22 +0000 Message-Id: <6abb18e6.196f4.386fcd2@gitrepo.freebsd.org> The branch stable/15 has been updated by maxim: URL: https://cgit.FreeBSD.org/src/commit/?id=da0067ded585fbf242fb15a7dbeb155130f1be6d commit da0067ded585fbf242fb15a7dbeb155130f1be6d Author: Maxim Konovalov AuthorDate: 2026-09-15 17:55:40 +0000 Commit: Maxim Konovalov CommitDate: 2026-09-29 01:47:44 +0000 ipfw: guard against NULL deref with clat/plat prefixes without length Found with: Claude Code Sonnet 5 MFC after: 2 weeks (cherry picked from commit 47b02ace19c53e72ad2290d974025292ff97464a) --- sbin/ipfw/nat64clat.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sbin/ipfw/nat64clat.c b/sbin/ipfw/nat64clat.c index 63fa7dae14e2..3fc7032683a6 100644 --- a/sbin/ipfw/nat64clat.c +++ b/sbin/ipfw/nat64clat.c @@ -208,6 +208,9 @@ nat64clat_create(const char *name, uint8_t set, int ac, char *av[]) if ((p = strchr(*av, '/')) != NULL) *p++ = '\0'; + else + errx(EX_USAGE, + "Prefix length required: %s", *av); if (inet_pton(AF_INET6, *av, &prefix) != 1) errx(EX_USAGE, "Bad prefix: %s", *av);