From 6c34dde83ee61fc0ba095dcfdac2f381f6bae007 Mon Sep 17 00:00:00 2001 From: Mark Johnston Date: Wed, 5 May 2021 17:06:23 -0400 Subject: igmp: Avoid an out-of-bounds access when zeroing counters When verifying, byte-by-byte, that the user-supplied counters are zero-filled, sysctl_igmp_stat() would check for zero before checking the loop bound. Perform the checks in the correct order. Reported by: KASAN MFC after: 1 week Sponsored by: The FreeBSD Foundation --- sys/netinet/igmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys/netinet/igmp.c') diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c index 21bce1ff885a..ef0da5e5cb46 100644 --- a/sys/netinet/igmp.c +++ b/sys/netinet/igmp.c @@ -382,7 +382,7 @@ sysctl_igmp_stat(SYSCTL_HANDLER_ARGS) * igps0 must be "all zero". */ p = (char *)&igps0; - while (*p == '\0' && p < (char *)&igps0 + sizeof(igps0)) + while (p < (char *)&igps0 + sizeof(igps0) && *p == '\0') p++; if (p != (char *)&igps0 + sizeof(igps0)) { error = EINVAL; -- cgit v1.2.3