CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/07/09 00:54:14
Modified files:
sys/net : pf.c
Log message:
pf(4) fix NULL pointer dereference in outbound packet path.
Outbound packet which matches rule with source limiter attached,
for example:
source limiter "crash" id 1 entries 10000 limit 1000
pass out from any to any source limiter "crash" keep state
triggers a NULL pointer dereference.
The issue was kindly reported and initial version of fix
submitted by SecBuddyF, Tencent KeenLab.
The submitted diff fixed the issue for failing look up by destination
address in outbound packet. dlg@ also pointed out the change should
be further improved so NULL pointer dereference is avoided when rule
uses nat-to/rdr-to option.
OK dlg@
