pf: Validate psn_len in DIOCGETSRCNODES
psn_len is controlled by user space, but we allocated memory based on it. Check how much memory we might need at most (i.e. how many source nodes we have) and limit the allocation to that. Reported by: markj MFC after: 1 week
This commit is contained in:
parent
264eeebe12
commit
180b0dcbbb
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=343295
@ -3577,14 +3577,18 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
|
||||
struct pf_src_node *n, *p, *pstore;
|
||||
uint32_t i, nr = 0;
|
||||
|
||||
for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
|
||||
i++, sh++) {
|
||||
PF_HASHROW_LOCK(sh);
|
||||
LIST_FOREACH(n, &sh->nodes, entry)
|
||||
nr++;
|
||||
PF_HASHROW_UNLOCK(sh);
|
||||
}
|
||||
|
||||
psn->psn_len = min(psn->psn_len,
|
||||
sizeof(struct pf_src_node) * nr);
|
||||
|
||||
if (psn->psn_len == 0) {
|
||||
for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
|
||||
i++, sh++) {
|
||||
PF_HASHROW_LOCK(sh);
|
||||
LIST_FOREACH(n, &sh->nodes, entry)
|
||||
nr++;
|
||||
PF_HASHROW_UNLOCK(sh);
|
||||
}
|
||||
psn->psn_len = sizeof(struct pf_src_node) * nr;
|
||||
break;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user