git: 47b02ace19c5 - main - ipfw: guard against NULL deref with clat/plat prefixes without length

From: Maxim Konovalov <maxim_at_FreeBSD.org>
Date: Tue, 15 Sep 2026 18:04:00 UTC
The branch main has been updated by maxim:

URL: https://cgit.FreeBSD.org/src/commit/?id=47b02ace19c53e72ad2290d974025292ff97464a

commit 47b02ace19c53e72ad2290d974025292ff97464a
Author:     Maxim Konovalov <maxim@FreeBSD.org>
AuthorDate: 2026-09-15 17:55:40 +0000
Commit:     Maxim Konovalov <maxim@FreeBSD.org>
CommitDate: 2026-09-15 18:03:32 +0000

    ipfw: guard against NULL deref with clat/plat prefixes without length
    
    Found with:     Claude Code Sonnet 5
    MFC after:      2 weeks
---
 sbin/ipfw/nat64clat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sbin/ipfw/nat64clat.c b/sbin/ipfw/nat64clat.c
index 63fa7dae14e2..3fc7032683a6 100644
--- a/sbin/ipfw/nat64clat.c
+++ b/sbin/ipfw/nat64clat.c
@@ -208,6 +208,9 @@ nat64clat_create(const char *name, uint8_t set, int ac, char *av[])
 
 			if ((p = strchr(*av, '/')) != NULL)
 				*p++ = '\0';
+			else
+				errx(EX_USAGE,
+				    "Prefix length required: %s", *av);
 			if (inet_pton(AF_INET6, *av, &prefix) != 1)
 				errx(EX_USAGE,
 				    "Bad prefix: %s", *av);