From nobody Fri Feb 20 02:24:32 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fHDbP392Jz6QRng for ; Fri, 20 Feb 2026 02:24:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fHDbN6pdXz3PNv for ; Fri, 20 Feb 2026 02:24:32 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1771554273; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8nMV/qzKSTzQqVkysnxM8qCP6mqPu/8Z76XWxJYUKG8=; b=uZv0MaBx1zUQ08+pXdskvB32AQQWJ4iwToPooXMXSmDSlTl8UyEWtfcvqmjarC94xVi+fj KaCf/v46rFelGTY6/FmBApHxzwUnbTQi5O+Bc810DWKWl8wdOpq2fJL1JA4+AnUC+y/f6L J0fzlGDh+OhIPhLdZ9zDIFoY6eUTkfEiEPvrDm6T+zV9+vqOv/xgAnIlrRESZba6d+AYGr vqrM/wN+6Ea1y8e2gwLxo2JDMyWCfa73RKS+ht0S8bqM4J0ZwvHY/VBY0OZ3ANhN7ihwSe BkV5p9FSxmuMwW4YYlGTs9rN0VmFHRFjvrMMSsata8kWPwBXv1RieYRX+rigVg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1771554273; a=rsa-sha256; cv=none; b=cj/dgWRDP0c84VT0t30b0sc/3GbOXmgryaKjWf0OqGn27i7TydFQHMgxxGD0LYdgmprfvi 19fjl9yIkS0UBw6u8qLRu0e/kNNJqH7Iz6/AKiTzVyxr7EJ7yogXVi7c0fi/XX4/2lnLvI ZXRqYCDIXudAQIBGOYaeYXi66kctV98tu7O8OzNWbVflSi3YO3Ljl0vahQJ2cZ42fsxN4A a05OUF+JmZiKA2ymPidooilpS3G97aUaQ6w1ETFVzvxjB7QA2z68+1P7UqErIsVhwvfaZH cnDu/VYYckGk6YkN2kQyDqLuGO9YE0jblhuEWyINLITzRDTzhU3Tg3LeeuGUmQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1771554273; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8nMV/qzKSTzQqVkysnxM8qCP6mqPu/8Z76XWxJYUKG8=; b=PlIUGLEoZncqgJSqSMprf4EdbbF0F8QKyzKJEglrdJPZF2tihdapdxrAW0Wbfqe9OWz6Be 1VCQnH4D5U8ypXrWTIiSW7c/Cmau6/M8s+E0dRW/q7ch9pbyS8gfRTMFTku+giOxHn8yxF Xrfy465f/OmTVLPyHY0gDvCD+mYXf9bM98XWOO6u3ATGAeam1DOV25bzH0GOtdX/dgJ0lu R7+8zZuJivNH1mHFafYYhAjSX5f/Dj8mHTw9lO17piu67sAuU3ri5+l4bsgxPMRmwRo7We ymTTsyx78CQxmw5i+TG80n1QWDz/U9pj4YyeKhzi1tJ89tD7dYVIpQ4p+r2RlA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fHDbN6P3Pz17MW for ; Fri, 20 Feb 2026 02:24:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1822b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 20 Feb 2026 02:24:32 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: bdf97b8f056f - stable/13 - ipfilter: Interface name must not extend beyond end of buffer List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: bdf97b8f056fcb842d4a4feb8c36008aa897cb62 Auto-Submitted: auto-generated Date: Fri, 20 Feb 2026 02:24:32 +0000 Message-Id: <6997c5e0.1822b.2f2cf975@gitrepo.freebsd.org> The branch stable/13 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=bdf97b8f056fcb842d4a4feb8c36008aa897cb62 commit bdf97b8f056fcb842d4a4feb8c36008aa897cb62 Author: Cy Schubert AuthorDate: 2026-01-08 17:41:53 +0000 Commit: Cy Schubert CommitDate: 2026-02-20 02:24:26 +0000 ipfilter: Interface name must not extend beyond end of buffer sifpidx (an interface name) cannot extend beyond the end of the fr_names buffer. We do the validation for fr_sifpidx here because it is a union that contains an offset only when fr_sifpidx points to an interface name, an offset into fr_names. The union is an offset into fr_names in this case only. interr_tbl now becomes a static variable outside a function to facilitate its use by two functions within fil.c Note that sifpidx is only used in ipf_sync() which implments ipf -y. Reported by: Ilja Van Sprundel MFC after: 1 week (cherry picked from commit 47fb51847fdea3f1cce841b5f2bbbcd6f8a04ee0) --- sys/netpfil/ipfilter/netinet/fil.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c index cf21c68b7b46..2b81af276cb9 100644 --- a/sys/netpfil/ipfilter/netinet/fil.c +++ b/sys/netpfil/ipfilter/netinet/fil.c @@ -240,6 +240,11 @@ static const struct optlist secopt[] = { { IPSO_CLASS_RES1, 0x80 } }; +/* + * Internal errors set by ipf_check_names_string(). + */ +static const int interr_tbl[3] = { 152, 156, 153 }; + char ipfilter_version[] = IPL_VERSION; int ipf_features = 0 @@ -3910,7 +3915,7 @@ ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) frentry_t *frt, *start = fr; frdest_t *fdp; char *name; - int error; + int error, interr; void *ifa; int v, i; @@ -3937,6 +3942,21 @@ ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) } if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { + /* + * We do the validation for fr_sifpidx here because + * it is a union that contains an offset only when + * fr_sifpidx points to an interface name, an offset + * into fr_names. The union is an offset into + * fr_names in this case only. + * + * Note that sifpidx is only used in ipf_sync() which + * implments ipf -y. + */ + if ((interr = ipf_check_names_string(fr->fr_names, fr->fr_namelen, fr->fr_sifpidx)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto unwind; + } if (fr->fr_satype != FRI_NORMAL && fr->fr_satype != FRI_LOOKUP) { ifa = ipf_resolvenic(softc, fr->fr_names + @@ -4408,7 +4428,6 @@ frrequest(ipf_main_softc_t *softc, int unit, ioctlcmd_t req, caddr_t data, int set, int makecopy) { int error = 0, in, family, need_free = 0, interr, i; - int interr_tbl[3] = { 152, 156, 153}; enum { OP_ADD, /* add rule */ OP_REM, /* remove rule */ OP_ZERO /* zero statistics and counters */ }