[Bug 207463] [patch] stable/10/sys/netpfil/pf/pf_ioctl.c:pfioctl(DIOCRSETADDRS) buffer overflow

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Wed Feb 24 23:19:10 UTC 2016


Kristof Provost <kp at freebsd.org> changed:

           What    |Removed                     |Added
                 CC|                            |kp at freebsd.org
           Assignee|freebsd-bugs at FreeBSD.org    |kp at freebsd.org

--- Comment #1 from Kristof Provost <kp at freebsd.org> ---
I think your analysis is correct.

The intention of the bcopy() appears to be to copy additional addresses behind
the original list (hence the adds + size + i construction).

You're correct that the buffer allocated by 'totlen = io->pfrio_size *
sizeof(struct pfr_addr);' is too small for that.
It's possible to panic a box that way.

I don't think your fix is sufficient though. If user space provides a smaller
pfrio_size2 than pfrio_size (remember that all user space programmers are out
to get us!) then we'd still end up running outsize the allocated buffer.

I think we need to allocate the largest of pfrio_size and pfrio_size2:

You are receiving this mail because:
You are on the CC list for the bug.

More information about the freebsd-stable mailing list