The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=81cac0d2f6035e02430fcdfa0ac8a081a9343f8d
commit 81cac0d2f6035e02430fcdfa0ac8a081a9343f8d Author: Kristof Provost <[email protected]> AuthorDate: 2022-03-29 12:17:12 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2022-03-30 08:28:19 +0000 pf: add missing input/error validation for DIOCGETETHRULE Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf_ioctl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 3cb5552d20c5..eae7b3bf1fa0 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2672,6 +2672,9 @@ DIOCGETETHRULES_error: #define ERROUT(x) do { error = (x); goto DIOCGETETHRULE_error; } while (0) + if (nv->len > pf_ioctl_maxcount) + ERROUT(ENOMEM); + nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); if (nvlpacked == NULL) ERROUT(ENOMEM); @@ -2681,6 +2684,8 @@ DIOCGETETHRULES_error: ERROUT(error); nvl = nvlist_unpack(nvlpacked, nv->len, 0); + if (nvl == NULL) + ERROUT(EBADMSG); if (! nvlist_exists_number(nvl, "ticket")) ERROUT(EBADMSG); ticket = nvlist_get_number(nvl, "ticket");
