git: 3fdbd8a07a2d - main - ipfilter: Avoid negative array indicies

The branch main has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=3fdbd8a07a2dcb8fe3cec19fc59ef064453e4755

commit 3fdbd8a07a2dcb8fe3cec19fc59ef064453e4755
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2026-02-11 19:30:38 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2026-02-17 02:21:59 +0000

    ipfilter: Avoid negative array indicies
    
    Array indices must always be posive. We avoid this by making each index
    unsigned. This mitigates out-of-bounds reads and writes.
    
    Reported by:            Ilja Van Sprundel <ivansprundel@ioactive.com>
    Reviewed by:            glebius
    MFC after:              3 days
    Differential revision:  https://reviews.freebsd.org/D55260
---
 sys/netpfil/ipfilter/netinet/fil.c      | 4 ++--
 sys/netpfil/ipfilter/netinet/ip_fil.h   | 2 +-
 sys/netpfil/ipfilter/netinet/ip_state.c | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c
index 657097ca7b85..9217572aac50 100644
--- a/sys/netpfil/ipfilter/netinet/fil.c
+++ b/sys/netpfil/ipfilter/netinet/fil.c
@@ -8530,7 +8530,7 @@ ipf_matcharray_load(ipf_main_softc_t *softc, caddr_t data, ipfobj_t *objp,
 int
 ipf_matcharray_verify(int *array, int arraysize)
 {
-	int i, nelem, maxidx;
+	u_int i, nelem, maxidx;
 	ipfexp_t *e;
 
 	nelem = arraysize / sizeof(*array);
@@ -8591,7 +8591,7 @@ ipf_matcharray_verify(int *array, int arraysize)
 static int
 ipf_fr_matcharray(fr_info_t *fin, int *array)
 {
-	int i, n, *x, rv, p;
+	u_int i, n, *x, rv, p;
 	ipfexp_t *e;
 
 	rv = 0;
diff --git a/sys/netpfil/ipfilter/netinet/ip_fil.h b/sys/netpfil/ipfilter/netinet/ip_fil.h
index 81ad50373fe9..dbfc045a8646 100644
--- a/sys/netpfil/ipfilter/netinet/ip_fil.h
+++ b/sys/netpfil/ipfilter/netinet/ip_fil.h
@@ -1473,7 +1473,7 @@ typedef struct ipfexp {
 	int		ipfe_cmd;
 	int		ipfe_not;
 	int		ipfe_narg;
-	int		ipfe_size;
+	u_int		ipfe_size;
 	int		ipfe_arg0[1];
 } ipfexp_t;
 
diff --git a/sys/netpfil/ipfilter/netinet/ip_state.c b/sys/netpfil/ipfilter/netinet/ip_state.c
index 8a21e7593995..c8d6e4e0feb3 100644
--- a/sys/netpfil/ipfilter/netinet/ip_state.c
+++ b/sys/netpfil/ipfilter/netinet/ip_state.c
@@ -4910,7 +4910,7 @@ ipf_state_matchflush(ipf_main_softc_t *softc, caddr_t data)
 static int
 ipf_state_matcharray(ipstate_t *state, int *array, u_long ticks)
 {
-	int i, n, *x, rv, p;
+	u_int i, n, *x, rv, p;
 	ipfexp_t *e;
 
 	rv = 0;