From nobody Mon Jun 15 13:12:09 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gf9WY4y73z6hKfw for ; Mon, 15 Jun 2026 13:12:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gf9WY4C1dz3ZXr for ; Mon, 15 Jun 2026 13:12:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781529129; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pN4Ca8Y54+Xf5Vzqzuu6MySRIXrHX5AQ3cGmSH7LsPQ=; b=OJkG9ywBh4m907wLXnYJRp38qgxZON5hoxF+JnCF19aj4Cq1tbY9EbJacipcvKNtksa5/+ JmBCojNlArg2s8N16XtxNBiT0SHx3/aOFEoR2L+70XuLHTqx1MxuZ46gM9CGLcxHqGyv4O UMa1kl5eJ7ALWToEoWI+ltmWwuwsbR7Y8Y58dwVCpd2A7laGvanjyi8MJpZqL5ICH8pprN HQ6H36jfk+atqesX9wkT7YeLp/1ChOGnehzykBAJlgKneK7VRrw5AxFYDx8C+3Pnn5QOlZ R0TosXMch2L4CCFZ6qi2M9cPQznqviDzYZzhHA2XqHl8WyXACD41arffVfNZQw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781529129; a=rsa-sha256; cv=none; b=k7jIxWmfcxBk4xsA14tqmVCOi7SPdO8kGO49JQjbL8K3TdU6CDKDQlGoBO2ANpfd8Ccerq yAal/1Ap4ERtGLRWGTNqjJf0i+CMlytGFCtqUto+NvszEgs3chTqa+2+LyVGN63+XoSgqT M0kvh7Pd0DL3tr/pvIaye/pl7aSg0utcmT4NwQ2EoQBmPFR8bJ8I8vuNhzUYtY5emIyTt2 FBN+uWdvGkbv786j/O5SYgPWHYEgpx0SmnRm4Bg0ZrxOKSgwkrjbYwleJweUsFwNkGKJ5A xtt2rkeUi9aqZawLucyjy/VEKaPF22bvUgQqcwI5rMD0wrKP50xWaSHV/X2oXA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781529129; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pN4Ca8Y54+Xf5Vzqzuu6MySRIXrHX5AQ3cGmSH7LsPQ=; b=E1MxFqWqLq6QhcrkOIU6lg/g08VcdGVDT7Vj6kXRhY/j58ZkWV3g0PDl8jkFWdupm8LSjS zF6yOZIQwpHP6xsHOFqnio1+2B46jWcVWAop0S89JzkgtNjESzRmY2gV9oPG2LCNWpF2q0 lplz8HIkJ2dVq7Zp8yeh+0WgNxQ1UiySzCQxbu3yn7LDUCyawdr7uhn8l6C8mEh+9I+QaC RWUEBTnAxpV5QQFz3kyuqz2BeiOTH8NaA/ueRyYhfKjl+KW6T2BYu/opYy1C27gUkcjXTq uK47ktrxwvNJaGu9yS9Z4CqTueoCKwnWLbv7UK8wqkJ5PNawpDkNA3FADuCYdw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gf9WY3kqHzxHv for ; Mon, 15 Jun 2026 13:12:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30d9d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 15 Jun 2026 13:12:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: 4c3fde8b835d - stable/15 - ipfilter: Fix ip_pptp_pxy (PPTP proxy) length underflow List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 4c3fde8b835d3a2d96805ce0c6565bce2f0bc731 Auto-Submitted: auto-generated Date: Mon, 15 Jun 2026 13:12:09 +0000 Message-Id: <6a2ffa29.30d9d.2c3603f5@gitrepo.freebsd.org> The branch stable/15 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=4c3fde8b835d3a2d96805ce0c6565bce2f0bc731 commit 4c3fde8b835d3a2d96805ce0c6565bce2f0bc731 Author: Cy Schubert AuthorDate: 2026-05-29 06:17:39 +0000 Commit: Cy Schubert CommitDate: 2026-06-15 13:11:49 +0000 ipfilter: Fix ip_pptp_pxy (PPTP proxy) length underflow A PPTP client sending a specially crafted PPTP message with a length smaller than the already processed fixed header can panic the system. This resultes in a negative remaining length (a large unsigned 16-bit number). Reported by: Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM-5.1 from Z.ai Differential Revision: https://reviews.freebsd.org/D57383 (cherry picked from commit 37e9d3641ba0e0da0d2bbaa26a59ee56a8cf3ee6) --- sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c b/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c index dc4c67dc14f0..95eaf78bd575 100644 --- a/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c +++ b/sys/netpfil/ipfilter/netinet/ip_pptp_pxy.c @@ -318,7 +318,9 @@ ipf_p_pptp_nextmessage(fr_info_t *fin, nat_t *nat, pptp_pxy_t *pptp, int rev) * it should match 1a2b3c4d. Byte order is ignored, * deliberately, when printing out the error. */ - len = MIN(8 - pptps->pptps_bytes, dlen); + if (pptps->pptps_bytes >= 8) + return (-1); + len = MIN((size_t)(8 - pptps->pptps_bytes), dlen); COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr); pptps->pptps_bytes += len; pptps->pptps_wptr += len; @@ -361,7 +363,9 @@ ipf_p_pptp_nextmessage(fr_info_t *fin, nat_t *nat, pptp_pxy_t *pptp, int rev) } } - len = MIN(pptps->pptps_len - pptps->pptps_bytes, dlen); + if (pptps->pptps_len <= pptps->pptps_bytes) + return (-1); + len = MIN((size_t)(pptps->pptps_len - pptps->pptps_bytes), dlen); COPYDATA(fin->fin_m, off, len, pptps->pptps_wptr); pptps->pptps_bytes += len; pptps->pptps_wptr += len;