From nobody Tue Feb 10 14:02:54 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4f9NYp5wGPz6RM28 for ; Tue, 10 Feb 2026 14:02:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4f9NYp51kxz3pG1 for ; Tue, 10 Feb 2026 14:02:54 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1770732174; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KDccAI87A/XdG0INtJ5muLz+6pdHk+peniNPYxVTXf8=; b=HptxxiRBH2dH6bgusa9k7HcBCdnjvkazS1IH9iplsS45CeDYb5SHCkh+xrq3rWCYeL+918 d8q+RUTpH2T5/8qFjJhjo0fIzU4u+YLync8BLXzVeCi8NxqduoBUvQlMejNrMW3BmrXod4 xjk7IS9v6AfCt5UuZRuj7isimedLMnY6+hbVLUQIkcqIXj7Oofo1Wzz0ECGxYMVfci5XQl AVzF6pt9AZQaj4XNKxdA7u8IgsL2Lm7ZHaZUGK7ish11YaKBF7EbRG3aC5q2NoKmVnaKZE SXXQwqC3M2MWDYaG8rlWjBjn8yeIbe8UjXclq/a3rI9AtsDkg0Bv70PDLlHuMg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1770732174; a=rsa-sha256; cv=none; b=X0sUtTZ0tiia00oy30142m2XGy/J9OMmcrHVByXKuJ9IIl+cpRK1n6yVEE41wqrdkk24v2 cvZXRkVhQvoDCqZsJJCxgMNn/6rN82RM42ORrZBkiPTrKU0CSBSJw9cIpMf4FEfSrkO6Q4 jqonl3KtfVyODnSFwlqppmb6HPsvhdb/6XQWAxsVGrWaHnpnv4z0IkeOarRFjoYJsVJtJf sXmWGkagZU+U+BiFcJOrHShtKo2vpBPZyRiLV+lAFvcg1AXCbPMmf3ABIzUmBGXbr1w32C h9gmLObj/Si1MS8w8tvuqnMXBN4M1CS1pSCMwYGyh0mRatPoinS1Fu57oKqxbQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1770732174; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KDccAI87A/XdG0INtJ5muLz+6pdHk+peniNPYxVTXf8=; b=IxqzPVaMmlezntNi/cM7A+PBQVyvkqjGtkakzLbcxH64zkvnt6df2WD++Cq2nLuq1QymEk tatP+ZM2kpOutLZEGQZwW5YmqpcJmDz3GNgDe7M8zj4A6FV8Ypn5+A7hObNlPBWG5YcIFX C21yeafvG929QBtbIZbyjQrvUoqJVeejQSzhI7pAuTCDruxh7xUHv3JLY4oNIslnvsLDzo JkkkCC3J5qmSCgXWc3rHQ0BISHzrcsdEa0oEqZJQLG/aV5vBBqnEHG8h1W+2bBKPZDHska 4s/bYSWP1Z3D1JKhNp0O8CjOQq6c+yvk9eBz0QFxcPbaDGbWFT1eRvQNM68ezA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4f9NYp4Q9mz1LQw for ; Tue, 10 Feb 2026 14:02:54 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3d6b9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 10 Feb 2026 14:02:54 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Cy Schubert Subject: git: 47fb51847fde - main - ipfilter: Interface name must not extend beyond end of buffer List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 47fb51847fdea3f1cce841b5f2bbbcd6f8a04ee0 Auto-Submitted: auto-generated Date: Tue, 10 Feb 2026 14:02:54 +0000 Message-Id: <698b3a8e.3d6b9.3be1dc3a@gitrepo.freebsd.org> The branch main has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=47fb51847fdea3f1cce841b5f2bbbcd6f8a04ee0 commit 47fb51847fdea3f1cce841b5f2bbbcd6f8a04ee0 Author: Cy Schubert AuthorDate: 2026-01-08 17:41:53 +0000 Commit: Cy Schubert CommitDate: 2026-02-10 14:02:18 +0000 ipfilter: Interface name must not extend beyond end of buffer sifpidx (an interface name) cannot extend beyond the end of the fr_names buffer. We do the validation for fr_sifpidx here because it is a union that contains an offset only when fr_sifpidx points to an interface name, an offset into fr_names. The union is an offset into fr_names in this case only. interr_tbl now becomes a static variable outside a function to facilitate its use by two functions within fil.c Note that sifpidx is only used in ipf_sync() which implments ipf -y. Reported by: Ilja Van Sprundel MFC after: 1 week --- sys/netpfil/ipfilter/netinet/fil.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/sys/netpfil/ipfilter/netinet/fil.c b/sys/netpfil/ipfilter/netinet/fil.c index 24ac91c69fc8..657097ca7b85 100644 --- a/sys/netpfil/ipfilter/netinet/fil.c +++ b/sys/netpfil/ipfilter/netinet/fil.c @@ -236,6 +236,11 @@ static const struct optlist secopt[] = { { IPSO_CLASS_RES1, 0x80 } }; +/* + * Internal errors set by ipf_check_names_string(). + */ +static const int interr_tbl[3] = { 152, 156, 153 }; + char ipfilter_version[] = IPL_VERSION; int ipf_features = 0 @@ -3906,7 +3911,7 @@ ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) frentry_t *frt, *start = fr; frdest_t *fdp; char *name; - int error; + int error, interr; void *ifa; int v, i; @@ -3933,6 +3938,21 @@ ipf_synclist(ipf_main_softc_t *softc, frentry_t *fr, void *ifp) } if ((fr->fr_type & ~FR_T_BUILTIN) == FR_T_IPF) { + /* + * We do the validation for fr_sifpidx here because + * it is a union that contains an offset only when + * fr_sifpidx points to an interface name, an offset + * into fr_names. The union is an offset into + * fr_names in this case only. + * + * Note that sifpidx is only used in ipf_sync() which + * implments ipf -y. + */ + if ((interr = ipf_check_names_string(fr->fr_names, fr->fr_namelen, fr->fr_sifpidx)) != 0) { + IPFERROR(interr_tbl[interr-1]); + error = EINVAL; + goto unwind; + } if (fr->fr_satype != FRI_NORMAL && fr->fr_satype != FRI_LOOKUP) { ifa = ipf_resolvenic(softc, fr->fr_names + @@ -4404,7 +4424,6 @@ frrequest(ipf_main_softc_t *softc, int unit, ioctlcmd_t req, caddr_t data, int set, int makecopy) { int error = 0, in, family, need_free = 0, interr, i; - int interr_tbl[3] = { 152, 156, 153}; enum { OP_ADD, /* add rule */ OP_REM, /* remove rule */ OP_ZERO /* zero statistics and counters */ }