From nobody Fri Feb 20 02:24:19 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fHDb74Myqz6QRqs for ; Fri, 20 Feb 2026 02:24:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fHDb720Z7z3NmF for ; Fri, 20 Feb 2026 02:24:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1771554259; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i9ceelVFkXWTp2PANvtl2ZTXOePUBUCk670Z9xqYxqQ=; b=dXyEXPxlWrMZsBjnPhCN5mZQ+M1Ath0wYdj4w/R/Vxix7zK6+eoQrYOZESzH/EYU4FUeJl D4uQg3QHvdFpJ9bgC3CriA1l5x4DrRHH93qRqIr/UjjIeuJ8XpB+DXnTAwDKK1WFczOctf o68X4xKytIaPxXIMq/zeHF1u5AkCirpFmNBJDvcxPzsoK7X7ULGADrQ+ee0bwo4DPdzsIt YMOkgfTBU7ALQiYVA9y6gdUchWzwt7JlvKjhHa9skRCN+MKvHXBBZS/2HqiZV5GyjPLvOB 0/AMlff9Qf3fU2fAqhKK5zBRpEMbhGo3tzwbUVBxTI2i/e1VoNKs/GJgK2qqTA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1771554259; a=rsa-sha256; cv=none; b=E9b6GQ4jOsdNn5WvM+LMmXKYTgvqPec5eoyc5mjN7u3Mqr8ImQzOaOanL10kAZYmKdutak ub+1r38GR7UzSI+Gdo/A7e0suI8w6e4XoVuxdgtAto386sa/QnJmguHpZN295NscePZTYO RDDUrbQVzRwvstoQ+shBv7A4TcJiaic/dLRSRMIUEVswE9HdZnPOllbuZ1g+yjMKL7ZRzu /+RfE0tYzJRWK32iLz89yhRKCYTKmhH3aBv5av/9LybKcx0TnYkicBsDY984gcmgZcEsYq g35MZDQD3+YuxZ3KV6VPol4GutpGZ5RIDEjtybrdY9qhyTh3vmLXm6oxxDlGpw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1771554259; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=i9ceelVFkXWTp2PANvtl2ZTXOePUBUCk670Z9xqYxqQ=; b=vKYE7R5+GOV7wctNkMIxJYgYqBM5LeFuxx6A9noifGZ6tV58YR3urnglAQugd4dnzLxMTn yiLFkgVGJ+Ex0Deb/lLDSPf2uFGwsywtkw+cYUqdIjKnwkJQufytvpFAbOr+MZh9es9Jax fgyF5mdvcdq7YSfAlvjqTfbrn3N8GSTpSDoKzZVuNFpjDsdHiqeLg7QSwK9BWQUE7/b8l1 AssdtmSbv+evhbpNYJU6IJBF2yfJXk7By7TZH9bEnbHr2bom6L2pYInacWfd1vjKIhYAUr IOLCGMgkVGb/eu0xe7RejCnkTxj9CJ0Umlt6nMDfWs8MkW7YnGyDLrhygB68XA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4fHDb71XdCz17vR for ; Fri, 20 Feb 2026 02:24:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18f9b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 20 Feb 2026 02:24:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Cy Schubert Subject: git: 60043137c50c - stable/14 - ipfilter: Interface name must not extend beyond end of buffer List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 60043137c50c635a5ad25428d1d99d22fcd4d226 Auto-Submitted: auto-generated Date: Fri, 20 Feb 2026 02:24:19 +0000 Message-Id: <6997c5d3.18f9b.f50d656@gitrepo.freebsd.org> The branch stable/14 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=60043137c50c635a5ad25428d1d99d22fcd4d226 commit 60043137c50c635a5ad25428d1d99d22fcd4d226 Author: Cy Schubert AuthorDate: 2026-01-08 17:41:53 +0000 Commit: Cy Schubert CommitDate: 2026-02-20 02:24:08 +0000 ipfilter: Interface name must not extend beyond end of buffer sifpidx (an interface name) cannot extend beyond the end of the fr_names buffer. We do the validation for fr_sifpidx here because it is a union that contains an offset only when fr_sifpidx points to an interface name, an offset into fr_names. The union is an offset into fr_names in this case only. interr_tbl now becomes a static variable outside a function to facilitate its use by two functions within fil.c Note that sifpidx is only used in ipf_sync() which implments ipf -y. Reported by: Ilja Van Sprundel MFC after: 1 week (cherry picked from commit 47fb51847fdea3f1cce841b5f2bbbcd6f8a04ee0) --- sys/netpfil/ipfilter/netinet/fil.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c index cf21c68b7b46..2b81af276cb9 100644 --- a/sys/netpfil/ipfilter/netinet/fil.c +++ b/sys/netpfil/ipfilter/netinet/fil.c @@ -240,6 +240,11 @@ static const struct optlist secopt[] = { { IPSO_CLASS_RES1, 0x80 } }; +/* + * Internal errors set by ipf_check_names_string(). + */ +static const int interr_tbl[3] = { 152, 156, 153 }; + char ipfilter_version[] = IPL_VERSION; int ipf_features = 0 @@ -3910,7 +3915,7 @@ ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) frentry_t *frt, *start = fr; frdest_t *fdp; char *name; - int error; + int error, interr; void *ifa; int v, i; @@ -3937,6 +3942,21 @@ ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) } if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { + /* + * We do the validation for fr_sifpidx here because + * it is a union that contains an offset only when + * fr_sifpidx points to an interface name, an offset + * into fr_names. The union is an offset into + * fr_names in this case only. + * + * Note that sifpidx is only used in ipf_sync() which + * implments ipf -y. + */ + if ((interr = ipf_check_names_string(fr->fr_names, fr->fr_namelen, fr->fr_sifpidx)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto unwind; + } if (fr->fr_satype != FRI_NORMAL && fr->fr_satype != FRI_LOOKUP) { ifa = ipf_resolvenic(softc, fr->fr_names + @@ -4408,7 +4428,6 @@ frrequest(ipf_main_softc_t *softc, int unit, ioctlcmd_t req, caddr_t data, int set, int makecopy) { int error = 0, in, family, need_free = 0, interr, i; - int interr_tbl[3] = { 152, 156, 153}; enum { OP_ADD, /* add rule */ OP_REM, /* remove rule */ OP_ZERO /* zero statistics and counters */ }