svn commit: r309027 - head/sbin/dhclient
Brooks Davis
brooks at FreeBSD.org
Tue Nov 22 22:45:17 UTC 2016
Author: brooks
Date: Tue Nov 22 22:45:15 2016
New Revision: 309027
URL: https://svnweb.freebsd.org/changeset/base/309027
Log:
Allocate a struct ifreq rather than using a (wrong) computed size for
the BIOCSETIF ioctl.
The kernel always copies an entire struct ifreq and IPv4 addresses will
always fit in an ifreq.
On systems with pointers larger than 64-bits, the computed size will be
less than the size of struct ifreq, potentially resulting in the kernel
attempting to copyin memory from outside the allocation.
Reviewed by: jhb
Obtained from: CheriBSD
MFC after: 1 week
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D8445
Modified:
head/sbin/dhclient/dispatch.c
Modified: head/sbin/dhclient/dispatch.c
==============================================================================
--- head/sbin/dhclient/dispatch.c Tue Nov 22 22:30:55 2016 (r309026)
+++ head/sbin/dhclient/dispatch.c Tue Nov 22 22:45:15 2016 (r309027)
@@ -106,8 +106,8 @@ discover_interfaces(struct interface_inf
if (foo.sin_addr.s_addr == htonl(INADDR_LOOPBACK))
continue;
if (!iface->ifp) {
- int len = IFNAMSIZ + ifa->ifa_addr->sa_len;
- if ((tif = malloc(len)) == NULL)
+ if ((tif = calloc(1, sizeof(struct ifreq)))
+ == NULL)
error("no space to remember ifp");
strlcpy(tif->ifr_name, ifa->ifa_name, IFNAMSIZ);
memcpy(&tif->ifr_addr, ifa->ifa_addr,
More information about the svn-src-all
mailing list