freebsd/freebsd-src
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-11-07 12:48:33 -10:00
Code Issues Packages Projects Releases Wiki Activity

ipfilter: Fix possible overrun

Browse Source 
The destination buffer is FR_GROUPLEN (16 bytes) in length. When
gname is created, the userspace utilities correctly use FR_GROUPLEN
as the buffer length. The kernel should also limit its copy operation to
FR_GROUPLEN bytes to avoid any user written code from exploiting this
vulnerability.

Reported by:	Ilja Van Sprundel <[email protected]>
MFC after:	1 week
This commit is contained in:
Cy Schubert committed 2026-02-04 12:46:20 -08:00
1 parent fe8105de14
commit e40817302e
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
sys/netpfil/ipfilter/netinet/fil.c
+1 -1
View File
@@ -3503,7 +3503,7 @@ ipf_group_add(ipf_main_softc_t *softc, char *group, void *head, u_32_t flags,
fg->fg_head = head;
fg->fg_start = NULL;
fg->fg_next = *fgp;
bcopy(group, fg->fg_name, strlen(group) + 1);
bcopy(group, fg->fg_name, strnlen(group, FR_GROUPLEN) + 1);
fg->fg_flags = gflags;
fg->fg_ref = 1;
fg->fg_set = &softc->ipf_groups[unit][set];