pf: Make tag hashing more robust
tagname2tag() hashes the tag name before truncating it to 63 characters. tag_unref() removes the tag from the name hash by computing the hash over the truncated name. Ensure that both operations compute the same hash for a given tag. The larger issue is a lack of string validation in pf(4) ioctl handlers. This is intended to be fixed with some future work, but an extra safety belt in tagname2hashindex() is worthwhile regardless. Reported by: syzbot+a0988828aafb00de7d68@syzkaller.appspotmail.com Reviewed by: kp MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D27346
This commit is contained in:
parent
384d27e04d
commit
5d49283f88
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=367987
@ -512,8 +512,10 @@ pf_cleanup_tagset(struct pf_tagset *ts)
|
||||
static uint16_t
|
||||
tagname2hashindex(const struct pf_tagset *ts, const char *tagname)
|
||||
{
|
||||
size_t len;
|
||||
|
||||
return (murmur3_32_hash(tagname, strlen(tagname), ts->seed) & ts->mask);
|
||||
len = strnlen(tagname, PF_TAG_NAME_SIZE - 1);
|
||||
return (murmur3_32_hash(tagname, len, ts->seed) & ts->mask);
|
||||
}
|
||||
|
||||
static uint16_t
|
||||
|
Loading…
Reference in New Issue
Block a user