⬢ DragonFlyBSD Kernel Audit
DF-0668 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
diff --git a/sys/net/ipfw3_basic/ip_fw3_table.c b/sys/net/ipfw3_basic/ip_fw3_table.c
--- a/sys/net/ipfw3_basic/ip_fw3_table.c
+++ b/sys/net/ipfw3_basic/ip_fw3_table.c
@@ -91,6 +91,11 @@
 	ioc_table = tbmsg->ioc_table;
 	int id = ioc_table->id;
 
+	if (id < 0 || id >= IPFW_TABLES_MAX) {
+		tbmsg->retval = EINVAL;
+		netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
+		return;
+	}
 	table_ctx = ctx->table_ctx;
 	table_ctx += id;
 	table_ctx->type = ioc_table->type;
@@ -123,6 +128,11 @@
 	struct ipfw3_table_context *table_ctx;
 
 	ioc_tbl = tbmsg->ioc_table;
+	if (ioc_tbl->id < 0 || ioc_tbl->id >= IPFW_TABLES_MAX) {
+		tbmsg->retval = EINVAL;
+		netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
+		return;
+	}
 	table_ctx = ctx->table_ctx;
 	table_ctx += ioc_tbl->id;
 	table_ctx->count = 0;
@@ -145,6 +155,11 @@
 	uint8_t mlen;
 
 	ioc_tbl = tbmsg->ioc_table;
+	if (ioc_tbl->id < 0 || ioc_tbl->id >= IPFW_TABLES_MAX) {
+		tbmsg->retval = EINVAL;
+		netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
+		return;
+	}
 	table_ctx = ctx->table_ctx;
 	table_ctx += ioc_tbl->id;
 	if (table_ctx->type != ioc_tbl->type)
@@ -201,6 +216,11 @@
 	uint8_t mlen;
 
 	ioc_tbl = tbmsg->ioc_table;
+	if (ioc_tbl->id < 0 || ioc_tbl->id >= IPFW_TABLES_MAX) {
+		tbmsg->retval = EINVAL;
+		netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
+		return;
+	}
 	table_ctx = ctx->table_ctx;
 	table_ctx += ioc_tbl->id;
 	if (table_ctx->type != ioc_tbl->type)
@@ -240,6 +260,11 @@
 	struct radix_node_head *rnh;
 
 	ioc_tbl = tbmsg->ioc_table;
+	if (ioc_tbl->id < 0 || ioc_tbl->id >= IPFW_TABLES_MAX) {
+		tbmsg->retval = EINVAL;
+		netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
+		return;
+	}
 	table_ctx = ctx->table_ctx;
 	table_ctx += ioc_tbl->id;
 	rnh = table_ctx->node;
@@ -261,6 +286,11 @@
 	struct ipfw3_table_context *table_ctx;
 
 	ioc_tbl = tbmsg->ioc_table;
+	if (ioc_tbl->id < 0 || ioc_tbl->id >= IPFW_TABLES_MAX) {
+		tbmsg->retval = EINVAL;
+		netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
+		return;
+	}
 	table_ctx = ctx->table_ctx;
 	table_ctx += ioc_tbl->id;
 	strlcpy(table_ctx->name, ioc_tbl->name, IPFW_TABLE_NAME_LEN);