svn commit: r286961 - stable/10/sys/netpfil/pf

[Luiz Otavio O Souza]

Author: loos
Date: Thu Aug 20 14:03:03 2015
New Revision: 286961
URL: https://svnweb.freebsd.org/changeset/base/286961

Log:
  MFC r286862:
  
    Fix the copy of addresses passed from userland in table replace command.
  
    The size2 is the maximum userland buffer size (used when the addresses are
    copied back to userland).
  
    Obtained from:	pfSense
    Sponsored by:	Rubicon Communications (Netgate)

Modified:
  stable/10/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf_ioctl.c	Thu Aug 20 13:37:08 2015	(r286960)
+++ stable/10/sys/netpfil/pf/pf_ioctl.c	Thu Aug 20 14:03:03 2015	(r286961)
@@ -2718,8 +2718,7 @@ DIOCCHANGEADDR_error:
 			error = ENODEV;
 			break;
 		}
-		totlen = (io->pfrio_size + io->pfrio_size2) *
-		    sizeof(struct pfr_addr);
+		totlen = io->pfrio_size * sizeof(struct pfr_addr);
 		pfras = malloc(totlen, M_TEMP, M_WAITOK);
 		error = copyin(io->pfrio_buffer, pfras, totlen);
 		if (error) {