From owner-svn-src-head@freebsd.org  Mon Aug 17 23:03:55 2015
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2A40B9BC59F;
 Mon, 17 Aug 2015 23:03:55 +0000 (UTC)
 (envelope-from loos@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 1AD92116B;
 Mon, 17 Aug 2015 23:03:55 +0000 (UTC)
 (envelope-from loos@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.70])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id t7HN3s8q083935;
 Mon, 17 Aug 2015 23:03:54 GMT (envelope-from loos@FreeBSD.org)
Received: (from loos@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id t7HN3sxC083934;
 Mon, 17 Aug 2015 23:03:54 GMT (envelope-from loos@FreeBSD.org)
Message-Id: <201508172303.t7HN3sxC083934@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: loos set sender to
 loos@FreeBSD.org using -f
From: Luiz Otavio O Souza <loos@FreeBSD.org>
Date: Mon, 17 Aug 2015 23:03:54 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r286862 - head/sys/netpfil/pf
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Aug 2015 23:03:55 -0000

Author: loos
Date: Mon Aug 17 23:03:54 2015
New Revision: 286862
URL: https://svnweb.freebsd.org/changeset/base/286862

Log:
  Fix the copy of addresses passed from userland in table replace command.
  
  The size2 is the maximum userland buffer size (used when the addresses are
  copied back to userland).
  
  Obtained from:	pfSense
  MFC after:	3 days
  Sponsored by:	Rubicon Communications (Netgate)

Modified:
  head/sys/netpfil/pf/pf_ioctl.c

Modified: head/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- head/sys/netpfil/pf/pf_ioctl.c	Mon Aug 17 21:07:21 2015	(r286861)
+++ head/sys/netpfil/pf/pf_ioctl.c	Mon Aug 17 23:03:54 2015	(r286862)
@@ -2724,8 +2724,7 @@ DIOCCHANGEADDR_error:
 			error = ENODEV;
 			break;
 		}
-		totlen = (io->pfrio_size + io->pfrio_size2) *
-		    sizeof(struct pfr_addr);
+		totlen = io->pfrio_size * sizeof(struct pfr_addr);
 		pfras = malloc(totlen, M_TEMP, M_WAITOK);
 		error = copyin(io->pfrio_buffer, pfras, totlen);
 		if (error) {