diff options
| author | loos <loos@FreeBSD.org> | 2015-08-20 14:03:03 +0000 |
|---|---|---|
| committer | loos <loos@FreeBSD.org> | 2015-08-20 14:03:03 +0000 |
| commit | 33f4807b1fb49724cbe245b65052f21e4b0f67fb (patch) | |
| tree | fdf3dbe656c491b81628ef80c67e2d552f1262fd | |
| parent | 473deb7c5c488a9679f25b85cf5b4855b1bbe509 (diff) | |
| download | FreeBSD-src-33f4807b1fb49724cbe245b65052f21e4b0f67fb.zip FreeBSD-src-33f4807b1fb49724cbe245b65052f21e4b0f67fb.tar.gz | |
MFC r286862:
Fix the copy of addresses passed from userland in table replace command.
The size2 is the maximum userland buffer size (used when the addresses are
copied back to userland).
Obtained from: pfSense
Sponsored by: Rubicon Communications (Netgate)
| -rw-r--r-- | sys/netpfil/pf/pf_ioctl.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index cf17466..a3528f0 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -2718,8 +2718,7 @@ DIOCCHANGEADDR_error: error = ENODEV; break; } - totlen = (io->pfrio_size + io->pfrio_size2) * - sizeof(struct pfr_addr); + totlen = io->pfrio_size * sizeof(struct pfr_addr); pfras = malloc(totlen, M_TEMP, M_WAITOK); error = copyin(io->pfrio_buffer, pfras, totlen); if (error) { |
