Date: Sat, 16 May 2026 21:25:48 +0000 From: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 3e2308d57080 - stable/15 - rtnetlink: Check for allocation failure in nlattr_get_multipath() Message-ID: <6a08e0dc.3f89d.3a118d23@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by pouria: URL: https://cgit.FreeBSD.org/src/commit/?id=3e2308d57080a2345e3db1139683368b504ee0bd commit 3e2308d57080a2345e3db1139683368b504ee0bd Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> AuthorDate: 2026-05-11 19:53:21 +0000 Commit: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> CommitDate: 2026-05-16 21:24:19 +0000 rtnetlink: Check for allocation failure in nlattr_get_multipath() Check for alloction failure on `npt_alloc()` for RTA_MULTIPATH attributes in `nlattr_get_multipath()`. Reported by: Joshua Rogers of AISLE Research Team Reviewed by: markj MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D56954 (cherry picked from commit 188631e43a1a5d2985156141c2e244a925670683) --- sys/netlink/route/rt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sys/netlink/route/rt.c b/sys/netlink/route/rt.c index 7641417a8e77..a76e00d34502 100644 --- a/sys/netlink/route/rt.c +++ b/sys/netlink/route/rt.c @@ -447,6 +447,10 @@ nlattr_get_multipath(struct nlattr *nla, struct nl_pstate *npt, max_nhops = data_len / sizeof(struct rtnexthop); mp = npt_alloc(npt, (max_nhops + 2) * sizeof(struct rta_mpath_nh)); + if (mp == NULL) { + NLMSG_REPORT_ERR_MSG(npt, "%s: too many RTA_MULTIPATH", __func__); + return (ENOMEM); + } mp->num_nhops = 0; for (rtnh = (struct rtnexthop *)(nla + 1); data_len > 0; ) {home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a08e0dc.3f89d.3a118d23>