The branch stable/13 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=82c84b850146e9c2ef7e6ea1b96e5d886d8cb2ad
commit 82c84b850146e9c2ef7e6ea1b96e5d886d8cb2ad Author: Mark Johnston <[email protected]> AuthorDate: 2021-05-05 21:06:23 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2021-05-12 13:31:39 +0000 igmp: Avoid an out-of-bounds access when zeroing counters When verifying, byte-by-byte, that the user-supplied counters are zero-filled, sysctl_igmp_stat() would check for zero before checking the loop bound. Perform the checks in the correct order. Reported by: KASAN Sponsored by: The FreeBSD Foundation (cherry picked from commit 6c34dde83ee61fc0ba095dcfdac2f381f6bae007) --- sys/netinet/igmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c index 21bce1ff885a..ef0da5e5cb46 100644 --- a/sys/netinet/igmp.c +++ b/sys/netinet/igmp.c @@ -382,7 +382,7 @@ sysctl_igmp_stat(SYSCTL_HANDLER_ARGS) * igps0 must be "all zero". */ p = (char *)&igps0; - while (*p == '\0' && p < (char *)&igps0 + sizeof(igps0)) + while (p < (char *)&igps0 + sizeof(igps0) && *p == '\0') p++; if (p != (char *)&igps0 + sizeof(igps0)) { error = EINVAL; _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all To unsubscribe, send any mail to "[email protected]"
