diff options
| author | cperciva <cperciva@FreeBSD.org> | 2006-01-25 10:00:40 +0000 |
|---|---|---|
| committer | cperciva <cperciva@FreeBSD.org> | 2006-01-25 10:00:40 +0000 |
| commit | 9b60b66d6c5eaffd5203d305fb1fa2c2d0a28411 (patch) | |
| tree | a93691f1612b440ad20be0c156aede2d28990c7f /sys/net/if_bridge.c | |
| parent | 4981e49c6bb7c134083c3f1856036b9d4d9dd1e4 (diff) | |
| download | FreeBSD-src-9b60b66d6c5eaffd5203d305fb1fa2c2d0a28411.zip FreeBSD-src-9b60b66d6c5eaffd5203d305fb1fa2c2d0a28411.tar.gz | |
Make sure buffers in if_bridge are fully initialized before copying
them to userland.
Security: FreeBSD-SA-06:06.kmem
Diffstat (limited to 'sys/net/if_bridge.c')
| -rw-r--r-- | sys/net/if_bridge.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index 1b0875b..69dc466 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -615,6 +615,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) break; } + bzero(&args, sizeof args); if (bc->bc_flags & BC_F_COPYIN) { error = copyin(ifd->ifd_data, &args, ifd->ifd_len); if (error) @@ -1022,6 +1023,7 @@ bridge_ioctl_gifs(struct bridge_softc *sc, void *arg) count = 0; len = bifc->ifbic_len; + bzero(&breq, sizeof breq); LIST_FOREACH(bif, &sc->sc_iflist, bif_next) { if (len < sizeof(breq)) break; @@ -1075,6 +1077,7 @@ bridge_ioctl_rts(struct bridge_softc *sc, void *arg) return (0); len = bac->ifbac_len; + bzero(&bareq, sizeof bareq); LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) { if (len < sizeof(bareq)) goto out; |
