Author: melifaro
Date: Sun Jun 5 10:33:53 2016
New Revision: 301440
URL: https://svnweb.freebsd.org/changeset/base/301440
Log:
Fix 4-byte overflow in ipv6_writemask.
This bug could cause some IPv6 table prefix delete requests to fail.
Obtained from: Yandex LLC
Modified:
head/sys/netpfil/ipfw/ip_fw_table_algo.c
Modified: head/sys/netpfil/ipfw/ip_fw_table_algo.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_table_algo.c Sun Jun 5 09:38:48 2016
(r301439)
+++ head/sys/netpfil/ipfw/ip_fw_table_algo.c Sun Jun 5 10:33:53 2016
(r301440)
@@ -590,7 +590,8 @@ ipv6_writemask(struct in6_addr *addr6, u
for (cp = (uint32_t *)addr6; mask >= 32; mask -= 32)
*cp++ = 0xFFFFFFFF;
- *cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0);
+ if (mask > 0)
+ *cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0);
}
#endif
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
