The branch main has been updated by markj:
URL:
https://cgit.FreeBSD.org/src/commit/?id=ba21825202737a8b7e90e1ef669c7fe7e7d50325
commit ba21825202737a8b7e90e1ef669c7fe7e7d50325
Author: Mark Johnston <ma...@freebsd.org>
AuthorDate: 2021-07-26 20:39:18 +0000
Commit: Mark Johnston <ma...@freebsd.org>
CommitDate: 2021-07-26 20:39:37 +0000
rip: Add missing minimum length validation in rip_output()
If the socket is configured such that the sender is expected to supply
the IP header, then we need to verify that it actually did so.
Reported by: syzkaller+KMSAN
Reviewed by: donner
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D31302
---
sys/netinet/raw_ip.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 1db73a6da68c..996440227145 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -523,8 +523,15 @@ rip_output(struct mbuf *m, struct socket *so, ...)
} else {
if (m->m_pkthdr.len > IP_MAXPACKET) {
m_freem(m);
- return(EMSGSIZE);
+ return (EMSGSIZE);
}
+ if (m->m_pkthdr.len < sizeof(*ip)) {
+ m_freem(m);
+ return (EINVAL);
+ }
+ m = m_pullup(m, sizeof(*ip));
+ if (m == NULL)
+ return (ENOMEM);
ip = mtod(m, struct ip *);
hlen = ip->ip_hl << 2;
if (m->m_len < hlen) {
_______________________________________________
dev-commits-src-main@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-main
To unsubscribe, send any mail to "dev-commits-src-main-unsubscr...@freebsd.org"
