From 960402d8a4c86e0690805d08a9234d62a335662e Mon Sep 17 00:00:00 2001 From: melifaro Date: Sat, 18 May 2013 04:49:00 +0000 Subject: Fix ipfw(8) sets of ipv6 addresses handling. Conditionally use stack buffer instead of calling strdup(). PR: bin/104921 MFC after: 2 weeks --- sbin/ipfw/ipfw2.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-) (limited to 'sbin/ipfw') diff --git a/sbin/ipfw/ipfw2.c b/sbin/ipfw/ipfw2.c index 5b37995..577d644 100644 --- a/sbin/ipfw/ipfw2.c +++ b/sbin/ipfw/ipfw2.c @@ -2779,13 +2779,19 @@ static ipfw_insn * add_src(ipfw_insn *cmd, char *av, u_char proto, int cblen) { struct in6_addr a; - char *host, *ch; + char *host, *ch, buf[INET6_ADDRSTRLEN]; ipfw_insn *ret = NULL; - - if ((host = strdup(av)) == NULL) - return NULL; - if ((ch = strrchr(host, '/')) != NULL) - *ch = '\0'; + int len; + + /* Copy first address in set if needed */ + if ((ch = strpbrk(av, "/,")) != NULL) { + len = ch - av; + strlcpy(buf, av, sizeof(buf)); + if (len < sizeof(buf)) + buf[len] = '\0'; + host = buf; + } else + host = av; if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || inet_pton(AF_INET6, host, &a) == 1) @@ -2797,7 +2803,6 @@ add_src(ipfw_insn *cmd, char *av, u_char proto, int cblen) if (ret == NULL && strcmp(av, "any") != 0) ret = cmd; - free(host); return ret; } @@ -2805,13 +2810,19 @@ static ipfw_insn * add_dst(ipfw_insn *cmd, char *av, u_char proto, int cblen) { struct in6_addr a; - char *host, *ch; + char *host, *ch, buf[INET6_ADDRSTRLEN]; ipfw_insn *ret = NULL; - - if ((host = strdup(av)) == NULL) - return NULL; - if ((ch = strrchr(host, '/')) != NULL) - *ch = '\0'; + int len; + + /* Copy first address in set if needed */ + if ((ch = strpbrk(av, "/,")) != NULL) { + len = ch - av; + strlcpy(buf, av, sizeof(buf)); + if (len < sizeof(buf)) + buf[len] = '\0'; + host = buf; + } else + host = av; if (proto == IPPROTO_IPV6 || strcmp(av, "me6") == 0 || inet_pton(AF_INET6, host, &a) == 1) @@ -2823,7 +2834,6 @@ add_dst(ipfw_insn *cmd, char *av, u_char proto, int cblen) if (ret == NULL && strcmp(av, "any") != 0) ret = cmd; - free(host); return ret; } -- cgit v1.1