diff options
| author | maxim <maxim@FreeBSD.org> | 2005-02-24 13:14:41 +0000 |
|---|---|---|
| committer | maxim <maxim@FreeBSD.org> | 2005-02-24 13:14:41 +0000 |
| commit | 2fa5f40c2d0699950e4aa9d952ef71e1fe5893d3 (patch) | |
| tree | 52717fc1fa6dd0777445d744391749a635c5e178 /sys/net/if_clone.c | |
| parent | b7895e139c78fb86ed45976951bb322d70a1a391 (diff) | |
| download | FreeBSD-src-2fa5f40c2d0699950e4aa9d952ef71e1fe5893d3.zip FreeBSD-src-2fa5f40c2d0699950e4aa9d952ef71e1fe5893d3.tar.gz | |
o Move ifcr_count sanity check up and reject negative values before we
panic at kmem_alloc() via malloc(9).
PR: kern/77748
Submitted by: Wojciech A. Koszek
OK'ed by: brooks
Security: local DoS, a sample code in the PR.
MFC after: 3 days
Diffstat (limited to 'sys/net/if_clone.c')
| -rw-r--r-- | sys/net/if_clone.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/sys/net/if_clone.c b/sys/net/if_clone.c index 389896d..7dd3d59 100644 --- a/sys/net/if_clone.c +++ b/sys/net/if_clone.c @@ -239,6 +239,9 @@ if_clone_list(struct if_clonereq *ifcr) struct if_clone *ifc; int buf_count, count, err = 0; + if (ifcr->ifcr_count < 0) + return (EINVAL); + IF_CLONERS_LOCK(); /* * Set our internal output buffer size. We could end up not @@ -261,12 +264,6 @@ if_clone_list(struct if_clonereq *ifcr) /* Just asking how many there are. */ goto done; } - - if (ifcr->ifcr_count < 0) { - err = EINVAL; - goto done; - } - count = (if_cloners_count < buf_count) ? if_cloners_count : buf_count; |
