Fix userland tools that don't check the format of routing socket

messages before accessing message fields that may not be present,
removing dead/duplicate/misleading code along the way.

Document the message format for each routing socket message in
route.h.

Fix a bug in usr.bin/netstat introduced in r287351 that resulted in
pointer computation with essentially random 16-bit offsets and
dereferencing of the results.

Reviewed by:	ae
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D10330

1 files changed, 9 insertions, 0 deletions

diff --git a/sbin/routed/table.c b/sbin/routed/table.c
index ce2c18d392e2..fe719cd31d29 100644
--- a/sbin/routed/table.c
+++ b/sbin/routed/table.c
@@ -1233,6 +1233,15 @@ read_rt(void)
 		if (m.r.rtm.rtm_type <= RTM_CHANGE)
 			strp += sprintf(strp," from pid %d",m.r.rtm.rtm_pid);
 
+		/*
+		 * Only messages that use the struct rt_msghdr format are
+		 * allowed beyond this point.
+		 */
+		if (m.r.rtm.rtm_type > RTM_RESOLVE) {
+			trace_act("ignore %s", str);
+			continue;
+		}
+		
 		rt_xaddrs(&info, m.r.addrs, &m.r.addrs[RTAX_MAX],
 			  m.r.rtm.rtm_addrs);