svn commit: r343295 - head/sys/netpfil/pf
Kristof Provost
kp at FreeBSD.org
Tue Jan 22 02:13:35 UTC 2019
Author: kp
Date: Tue Jan 22 02:13:33 2019
New Revision: 343295
URL: https://svnweb.freebsd.org/changeset/base/343295
Log:
pf: Validate psn_len in DIOCGETSRCNODES
psn_len is controlled by user space, but we allocated memory based on it.
Check how much memory we might need at most (i.e. how many source nodes we
have) and limit the allocation to that.
Reported by: markj
MFC after: 1 week
Modified:
head/sys/netpfil/pf/pf_ioctl.c
Modified: head/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- head/sys/netpfil/pf/pf_ioctl.c Tue Jan 22 02:04:37 2019 (r343294)
+++ head/sys/netpfil/pf/pf_ioctl.c Tue Jan 22 02:13:33 2019 (r343295)
@@ -3577,14 +3577,18 @@ DIOCCHANGEADDR_error:
struct pf_src_node *n, *p, *pstore;
uint32_t i, nr = 0;
+ for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
+ i++, sh++) {
+ PF_HASHROW_LOCK(sh);
+ LIST_FOREACH(n, &sh->nodes, entry)
+ nr++;
+ PF_HASHROW_UNLOCK(sh);
+ }
+
+ psn->psn_len = min(psn->psn_len,
+ sizeof(struct pf_src_node) * nr);
+
if (psn->psn_len == 0) {
- for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
- i++, sh++) {
- PF_HASHROW_LOCK(sh);
- LIST_FOREACH(n, &sh->nodes, entry)
- nr++;
- PF_HASHROW_UNLOCK(sh);
- }
psn->psn_len = sizeof(struct pf_src_node) * nr;
break;
}
More information about the svn-src-all
mailing list