d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix the copy of addresses passed from userland in table replace command.

Browse Source 
The size2 is the maximum userland buffer size (used when the addresses are
copied back to userland).

Obtained from:	pfSense
MFC after:	3 days
Sponsored by:	Rubicon Communications (Netgate)
This commit is contained in:
Luiz Otavio O Souza 2015-08-17 23:03:54 +00:00
parent e462b12755
commit f2fc809dcd
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/netpfil/pf/pf_ioctl.c
View File

@ -2724,8 +2724,7 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td
error = ENODEV;
break;
}
totlen = (io->pfrio_size + io->pfrio_size2) *
sizeof(struct pfr_addr);
totlen = io->pfrio_size * sizeof(struct pfr_addr);
pfras = malloc(totlen, M_TEMP, M_WAITOK);
error = copyin(io->pfrio_buffer, pfras, totlen);
if (error) {