⬢ DragonFlyBSD Kernel Audit
DF-4746 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
--- a/sys/dev/netif/lnc/am79900.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/dev/netif/lnc/am79900.c	2026-10-26 03:55:24.285175513 +0000
@@ -548,6 +548,14 @@
 		if (m == NULL)
 			break;
 
+		if (m->m_pkthdr.len > LEBLEN - ETHER_CRC_LEN) {
+			/* lance_put has no bound: never hand it an
+			 * oversized chain */
+			ifp->if_oerrors++;
+			m_freem(m);
+			continue;
+		}
+
 		/*
 		 * If BPF is listening on this interface, let it see the packet
 		 * before we commit it to the wire.
--- a/sys/dev/netif/lnc/am7990.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/dev/netif/lnc/am7990.c	2026-10-26 03:55:24.309175209 +0000
@@ -511,6 +511,14 @@
 		if (m == NULL)
 			break;
 
+		if (m->m_pkthdr.len > LEBLEN - ETHER_CRC_LEN) {
+			/* lance_put has no bound: never hand it an
+			 * oversized chain */
+			ifp->if_oerrors++;
+			m_freem(m);
+			continue;
+		}
+
 		/*
 		 * If BPF is listening on this interface, let it see the
 		 * packet before we commit it to the wire.