diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2024-06-05 21:55:37 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2024-06-06 13:45:31 +0000 |
| commit | dc3ee89c86d30cc7a14dce9550bbd4d37c7ff182 (patch) | |
| tree | 9f8a44ac111bf2d4e2c71f170f1e0cc8060e16a0 /sbin | |
| parent | 8f04209d37ec14e28aaeb14a7a020dac9fb4983b (diff) | |
| download | src-dc3ee89c86d30cc7a14dce9550bbd4d37c7ff182.tar.gz src-dc3ee89c86d30cc7a14dce9550bbd4d37c7ff182.zip | |
pfctl: fix possible out-of-bounds read
Tags in $10 (filter_opts) are not guaranteed to be the maximum possible
tag length, so memcpy() can end up reading outside of the allocated
buffer.
Use strlcpy() instead.
Reported by: CheriBSD
Event: Kitchener-Waterloo Hackathon 202406
Diffstat (limited to 'sbin')
| -rw-r--r-- | sbin/pfctl/parse.y | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 92e6e36f3b23..19e029c881d1 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -1230,7 +1230,7 @@ etherrule : ETHER action dir quick interface bridge etherproto etherfromto l3fro r.direction = $3; r.quick = $4.quick; if ($10.tag != NULL) - memcpy(&r.tagname, $10.tag, sizeof(r.tagname)); + strlcpy(r.tagname, $10.tag, sizeof(r.tagname)); if ($10.match_tag) if (strlcpy(r.match_tagname, $10.match_tag, PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { @@ -1240,7 +1240,7 @@ etherrule : ETHER action dir quick interface bridge etherproto etherfromto l3fro } r.match_tag_not = $10.match_tag_not; if ($10.queues.qname != NULL) - memcpy(&r.qname, $10.queues.qname, sizeof(r.qname)); + strlcpy(r.qname, $10.queues.qname, sizeof(r.qname)); r.dnpipe = $10.dnpipe; r.dnflags = $10.free_flags; if (eth_rule_label(&r, $10.label)) |