d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ifconf(): Always zero the whole struct ifreq.

Browse Source 
The previous split of zeroing ifr_name and ifr_addr seperately is safe
on current architectures, but would be unsafe if pointers were larger
than 8 bytes. Combining the zeroing adds no real cost (a few
instructions) and makes the security property easier to verify.

Reviewed by:	kib, emaste
Obtained from:	CheriBSD
MFC after:	3 days
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D14912
This commit is contained in:
Brooks Davis 2018-04-05 21:58:28 +00:00
parent 89ea4a30d6
commit 2443045f30
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=332087
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/net/if.c
View File

@ -3129,10 +3129,10 @@ ifconf(u_long cmd, caddr_t data)
int addrs;
/*
* Zero the ifr_name buffer to make sure we don't
* disclose the contents of the stack.
* Zero the ifr to make sure we don't disclose the contents
* of the stack.
*/
memset(ifr.ifr_name, 0, sizeof(ifr.ifr_name));
memset(&ifr, 0, sizeof(ifr));
if (strlcpy(ifr.ifr_name, ifp->if_xname, sizeof(ifr.ifr_name))
>= sizeof(ifr.ifr_name)) {
@ -3166,7 +3166,6 @@ ifconf(u_long cmd, caddr_t data)
}
IF_ADDR_RUNLOCK(ifp);
if (addrs == 0) {
bzero((caddr_t)&ifr.ifr_addr, sizeof(ifr.ifr_addr));
sbuf_bcat(sb, &ifr, sizeof(ifr));
max_len += sizeof(ifr);