Date: Thu, 21 Nov 2024 20:55:34 GMT From: Ed Maste <emaste@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: ae4f39464c61 - main - ng_parse: disallow negative length for malloc Message-ID: <202411212055.4ALKtYK1037338@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=ae4f39464c61182c2bdfd3cc61594f8707b3daf0 commit ae4f39464c61182c2bdfd3cc61594f8707b3daf0 Author: Ed Maste <emaste@FreeBSD.org> AuthorDate: 2022-11-01 14:01:29 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2024-11-21 20:53:04 +0000 ng_parse: disallow negative length for malloc This is an interim robustness improvement; further improvements as described in the PR and/or Phabricator review are still needed. PR: 267334 Reported by: Robert Morris <rtm@lcs.mit.edu> Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D37229 --- sys/netgraph/ng_parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/netgraph/ng_parse.c b/sys/netgraph/ng_parse.c index e11070274484..1a1d9d8b3064 100644 --- a/sys/netgraph/ng_parse.c +++ b/sys/netgraph/ng_parse.c @@ -1207,6 +1207,8 @@ ng_parse_composite(const struct ng_parse_type *type, const char *s, int align, len, blen, error = 0; /* Initialize */ + if (num < 0) + return (EINVAL); foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO); if (foff == NULL) { error = ENOMEM;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202411212055.4ALKtYK1037338>