https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=277456
Bug ID: 277456
Summary: netipsec: kdebug_sadb invalid length check for
sadb_ext_len
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 248900
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=248900&action=edit
Patch
Besides not doing any sufficient check that the length of a parsed message is
not bigger than the actual allocated buffer, kdebug_sadb() incorrectly compares
ext->sadb_ext_len, the extension payload size in 8 byte chunks, with tlen,
which is the full message payload size in bytes.
This should compare PFKEY_UNUNIT64(ext->sadb_ext_len) with tlen instead.
fix attached.
--
You are receiving this mail because:
You are the assignee for the bug.
