svn commit: r254630 - in releng/9.2/sys: netinet netinet6

[Xin LI]

Author: delphij
Date: Thu Aug 22 00:51:43 2013
New Revision: 254630
URL: http://svnweb.freebsd.org/changeset/base/254630

Log:
  Fix an integer overflow in computing the size of a temporary buffer
  can result in a buffer which is too small for the requested
  operation.
  
  Security:	CVE-2013-3077
  Security:	FreeBSD-SA-13:09.ip_multicast
  Approved by:	re (kib)

Modified:
  releng/9.2/sys/netinet/in_mcast.c
  releng/9.2/sys/netinet6/in6_mcast.c

Modified: releng/9.2/sys/netinet/in_mcast.c
==============================================================================
--- releng/9.2/sys/netinet/in_mcast.c	Thu Aug 22 00:51:37 2013	(r254629)
+++ releng/9.2/sys/netinet/in_mcast.c	Thu Aug 22 00:51:43 2013	(r254630)
@@ -1614,6 +1614,8 @@ inp_get_source_filters(struct inpcb *inp
 	 * has asked for, but we always tell userland how big the
 	 * buffer really needs to be.
 	 */
+	if (msfr.msfr_nsrcs > in_mcast_maxsocksrc)
+		msfr.msfr_nsrcs = in_mcast_maxsocksrc;
 	tss = NULL;
 	if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) {
 		tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs,

Modified: releng/9.2/sys/netinet6/in6_mcast.c
==============================================================================
--- releng/9.2/sys/netinet6/in6_mcast.c	Thu Aug 22 00:51:37 2013	(r254629)
+++ releng/9.2/sys/netinet6/in6_mcast.c	Thu Aug 22 00:51:43 2013	(r254630)
@@ -1625,6 +1625,8 @@ in6p_get_source_filters(struct inpcb *in
 	 * has asked for, but we always tell userland how big the
 	 * buffer really needs to be.
 	 */
+	if (msfr.msfr_nsrcs > in6_mcast_maxsocksrc)
+		msfr.msfr_nsrcs = in6_mcast_maxsocksrc;
 	tss = NULL;
 	if (msfr.msfr_srcs != NULL && msfr.msfr_nsrcs > 0) {
 		tss = malloc(sizeof(struct sockaddr_storage) * msfr.msfr_nsrcs,