svn commit: r301440 - head/sys/netpfil/ipfw

[Alexander V. Chernikov]

Author: melifaro
Date: Sun Jun  5 10:33:53 2016
New Revision: 301440
URL: https://svnweb.freebsd.org/changeset/base/301440

Log:
  Fix 4-byte overflow in ipv6_writemask.
  
  This bug could cause some IPv6 table prefix delete requests to fail.
  
  Obtained from:	Yandex LLC

Modified:
  head/sys/netpfil/ipfw/ip_fw_table_algo.c

Modified: head/sys/netpfil/ipfw/ip_fw_table_algo.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_table_algo.c	Sun Jun  5 09:38:48 2016	(r301439)
+++ head/sys/netpfil/ipfw/ip_fw_table_algo.c	Sun Jun  5 10:33:53 2016	(r301440)
@@ -590,7 +590,8 @@ ipv6_writemask(struct in6_addr *addr6, u
 
 	for (cp = (uint32_t *)addr6; mask >= 32; mask -= 32)
 		*cp++ = 0xFFFFFFFF;
-	*cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0);
+	if (mask > 0)
+		*cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0);
 }
 #endif