Date: Sun, 5 Jun 2016 10:33:53 +0000 (UTC) From: "Alexander V. Chernikov" <melifaro@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r301440 - head/sys/netpfil/ipfw Message-ID: <201606051033.u55AXroJ040540@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: melifaro Date: Sun Jun 5 10:33:53 2016 New Revision: 301440 URL: https://svnweb.freebsd.org/changeset/base/301440 Log: Fix 4-byte overflow in ipv6_writemask. This bug could cause some IPv6 table prefix delete requests to fail. Obtained from: Yandex LLC Modified: head/sys/netpfil/ipfw/ip_fw_table_algo.c Modified: head/sys/netpfil/ipfw/ip_fw_table_algo.c ============================================================================== --- head/sys/netpfil/ipfw/ip_fw_table_algo.c Sun Jun 5 09:38:48 2016 (r301439) +++ head/sys/netpfil/ipfw/ip_fw_table_algo.c Sun Jun 5 10:33:53 2016 (r301440) @@ -590,7 +590,8 @@ ipv6_writemask(struct in6_addr *addr6, u for (cp = (uint32_t *)addr6; mask >= 32; mask -= 32) *cp++ = 0xFFFFFFFF; - *cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0); + if (mask > 0) + *cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0); } #endif
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201606051033.u55AXroJ040540>