diff options
| author | cy <cy@FreeBSD.org> | 2017-04-23 03:16:38 +0000 |
|---|---|---|
| committer | cy <cy@FreeBSD.org> | 2017-04-23 03:16:38 +0000 |
| commit | c7a6e462c3bd68f7d5abd3526f03c80694ab0523 (patch) | |
| tree | e5d80138dbc5cec9eecf4940cd6d3105d5fde315 /contrib/ipfilter | |
| parent | 0541fbfd4945a1e55d54c1329cc9f19c3ed9072f (diff) | |
| download | FreeBSD-src-c7a6e462c3bd68f7d5abd3526f03c80694ab0523.zip FreeBSD-src-c7a6e462c3bd68f7d5abd3526f03c80694ab0523.tar.gz | |
MFC r316993, r316994, r316997 as follows:
r316993:
Fix CID 1372601 in ipfilter/lib/parsefields.c, possible NULL pointer
dereference should reallocarray() fail.
Reported by: Coverity CID 1372601
r316994:
Fix CID 1372600 in ipfilter/tools/ipf_y.y, possible NULL pointer
dereference should reallocarray() fail.
Reported by: Coverity CID 1372600
r316997:
Use warnx() to issue error message.
Reported by: cem
Diffstat (limited to 'contrib/ipfilter')
| -rw-r--r-- | contrib/ipfilter/lib/parsefields.c | 5 | ||||
| -rw-r--r-- | contrib/ipfilter/tools/ipf_y.y | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/contrib/ipfilter/lib/parsefields.c b/contrib/ipfilter/lib/parsefields.c index 241496c..9707159 100644 --- a/contrib/ipfilter/lib/parsefields.c +++ b/contrib/ipfilter/lib/parsefields.c @@ -1,4 +1,5 @@ #include "ipf.h" +#include <err.h> extern int nohdrfields; @@ -32,6 +33,10 @@ wordtab_t *parsefields(table, arg) fields = malloc(2 * sizeof(*fields)); } else { fields = realloc(fields, (num + 1) * sizeof(*fields)); + if (fields == NULL) { + warnx("memory allocation error at %d in %s in %s", __LINE__, __FUNCTION__, __FILE__); + abort(); + } } if (t == NULL) { diff --git a/contrib/ipfilter/tools/ipf_y.y b/contrib/ipfilter/tools/ipf_y.y index e0dc847..2ff9abd 100644 --- a/contrib/ipfilter/tools/ipf_y.y +++ b/contrib/ipfilter/tools/ipf_y.y @@ -9,6 +9,7 @@ #include "ipf.h" #include <sys/ioctl.h> #include <syslog.h> +#include <err.h> #ifdef IPFILTER_BPF # include <pcap.h> #endif @@ -2195,6 +2196,10 @@ char *phrase; for (i = 0, s = strtok(phrase, " \r\n\t"); s != NULL; s = strtok(NULL, " \r\n\t"), i++) { fb = realloc(fb, (i / 4 + 1) * sizeof(*fb)); + if (fb == NULL) { + warnx("memory allocation error at %d in %s in %s", __LINE__, __FUNCTION__, __FILE__); + abort(); + } l = (u_32_t)strtol(s, NULL, 0); switch (i & 3) { |
