⬢ DragonFlyBSD Kernel Audit
DF-3506 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
--- a/sys/netgraph/fec/ng_fec.c
+++ b/sys/netgraph/fec/ng_fec.c
@@ -1170,10 +1170,20 @@
 	case NGM_FEC_COOKIE:
 		switch (msg->header.cmd) {
 		case NGM_FEC_ADD_IFACE:
+			if (msg->header.arglen < 2 ||
+			    memchr(msg->data, '\0', msg->header.arglen) == NULL) {
+				error = EINVAL;
+				break;
+			}
 			ifname = msg->data;
 			error = ng_fec_addport(priv, ifname);
 			break;
 		case NGM_FEC_DEL_IFACE:
+			if (msg->header.arglen < 2 ||
+			    memchr(msg->data, '\0', msg->header.arglen) == NULL) {
+				error = EINVAL;
+				break;
+			}
 			ifname = msg->data;
 			error = ng_fec_delport(priv, ifname);
 			break;
--- a/sys/netgraph/fec/ng_fec.c
+++ b/sys/netgraph/fec/ng_fec.c
@@ -273,7 +273,7 @@
 		newarray = kmalloc(newlen * sizeof(*ng_fec_units),
 				   M_NETGRAPH, M_NOWAIT);
 		if (newarray == NULL)
 			return (ENOMEM);
-		bcopy(ng_fec_units, newarray,
-		    ng_fec_units_len * sizeof(*ng_fec_units));
+		if (ng_fec_units_len > 0)
+			bcopy(ng_fec_units, newarray,
+			    ng_fec_units_len * sizeof(*ng_fec_units));
 		for (i = ng_fec_units_len; i < newlen; i++)
 			newarray[i] = ~0;