The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=ae4f39464c61182c2bdfd3cc61594f8707b3daf0
commit ae4f39464c61182c2bdfd3cc61594f8707b3daf0 Author: Ed Maste <[email protected]> AuthorDate: 2022-11-01 14:01:29 +0000 Commit: Ed Maste <[email protected]> CommitDate: 2024-11-21 20:53:04 +0000 ng_parse: disallow negative length for malloc This is an interim robustness improvement; further improvements as described in the PR and/or Phabricator review are still needed. PR: 267334 Reported by: Robert Morris <[email protected]> Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D37229 --- sys/netgraph/ng_parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/netgraph/ng_parse.c b/sys/netgraph/ng_parse.c index e11070274484..1a1d9d8b3064 100644 --- a/sys/netgraph/ng_parse.c +++ b/sys/netgraph/ng_parse.c @@ -1207,6 +1207,8 @@ ng_parse_composite(const struct ng_parse_type *type, const char *s, int align, len, blen, error = 0; /* Initialize */ + if (num < 0) + return (EINVAL); foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO); if (foff == NULL) { error = ENOMEM;
