DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2582

Unbounded shift and missing masklen=0 guard in table_append_dispatch yield wrong mask (logic bug UB)

Summary

table_append_dispatch computes htonl(~((1<<(32-mlen))-1)) directly from user-supplied uint8_t masklen no clamp. mlen>32 UB negative shift x86 masks to 5 bits wrong mask. mlen==0 evaluates 1<<32 UB and unlike table_remove_dispatch (:215) append path lacks mlen? :0 guard so /0 stored as /32 firewall correctness bug. Logic/UB not memory corruption.

Discussion (0)

No comments yet.