svn commit: r296025 - head/sys/netpfil/pf

[Conrad Meyer]

On Wed, Feb 24, 2016 at 11:41 PM, Adrian Chadd <adrian.chadd at gmail.com> wrote:
> .. what's capping totlen so one doesn't run out of memory?

There was a DoS vector before (user controlled io->pfrio_size) and
basically the same DoS vector now (either of io->pfrio_size or
io->pfrio_size2).  This change isn't a regression.  Still, it should
be fixed.

Best,
Conrad

> On 24 February 2016 at 23:33, Kristof Provost <kp at freebsd.org> wrote:
>> ...
>> Modified: head/sys/netpfil/pf/pf_ioctl.c
>> ==============================================================================
>> --- head/sys/netpfil/pf/pf_ioctl.c      Thu Feb 25 07:03:10 2016        (r296024)
>> +++ head/sys/netpfil/pf/pf_ioctl.c      Thu Feb 25 07:33:59 2016        (r296025)
>> @@ -2718,13 +2718,14 @@ DIOCCHANGEADDR_error:
>>         case DIOCRSETADDRS: {
>>                 struct pfioc_table *io = (struct pfioc_table *)addr;
>>                 struct pfr_addr *pfras;
>> -               size_t totlen;
>> +               size_t totlen, count;
>>
>>                 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
>>                         error = ENODEV;
>>                         break;
>>                 }
>> -               totlen = io->pfrio_size * sizeof(struct pfr_addr);
>> +               count = max(io->pfrio_size, io->pfrio_size2);
>> +               totlen = count * sizeof(struct pfr_addr);
>>                 pfras = malloc(totlen, M_TEMP, M_WAITOK);
>>                 error = copyin(io->pfrio_buffer, pfras, totlen);
>>                 if (error) {
>>
>