diff options
| author | brooks <brooks@FreeBSD.org> | 2016-11-30 01:22:12 +0000 |
|---|---|---|
| committer | brooks <brooks@FreeBSD.org> | 2016-11-30 01:22:12 +0000 |
| commit | 6a086b92bdfc8f8b56d67d90c51ec0d45dfc8547 (patch) | |
| tree | f67908952970fbcc4bcc47d7ea76d23d358975ba /sbin | |
| parent | 3d2d7a75e475fa129c001fa8411a5ad5f3a08958 (diff) | |
| download | FreeBSD-src-6a086b92bdfc8f8b56d67d90c51ec0d45dfc8547.zip FreeBSD-src-6a086b92bdfc8f8b56d67d90c51ec0d45dfc8547.tar.gz | |
MFC r309027:
Allocate a struct ifreq rather than using a (wrong) computed size for
the BIOCSETIF ioctl.
The kernel always copies an entire struct ifreq and IPv4 addresses will
always fit in an ifreq.
On systems with pointers larger than 64-bits, the computed size will be
less than the size of struct ifreq, potentially resulting in the kernel
attempting to copyin memory from outside the allocation.
Reviewed by: jhb
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D8445
Diffstat (limited to 'sbin')
| -rw-r--r-- | sbin/dhclient/dispatch.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sbin/dhclient/dispatch.c b/sbin/dhclient/dispatch.c index 3ee0cf6..3317ceb 100644 --- a/sbin/dhclient/dispatch.c +++ b/sbin/dhclient/dispatch.c @@ -105,8 +105,8 @@ discover_interfaces(struct interface_info *iface) if (foo.sin_addr.s_addr == htonl(INADDR_LOOPBACK)) continue; if (!iface->ifp) { - int len = IFNAMSIZ + ifa->ifa_addr->sa_len; - if ((tif = malloc(len)) == NULL) + if ((tif = calloc(1, sizeof(struct ifreq))) + == NULL) error("no space to remember ifp"); strlcpy(tif->ifr_name, ifa->ifa_name, IFNAMSIZ); memcpy(&tif->ifr_addr, ifa->ifa_addr, |
