diff options
| author | Dag-Erling Smørgrav <des@FreeBSD.org> | 2025-07-31 10:06:47 +0000 |
|---|---|---|
| committer | Dag-Erling Smørgrav <des@FreeBSD.org> | 2025-08-06 13:52:14 +0000 |
| commit | f318186deb3ef3b90104e8372563e80c9358183e (patch) | |
| tree | fb764784ea0ff7100999765bb8055a88ea751e8a | |
| parent | aadc10e7ce1a8bb47cd628a2111b71fac3684915 (diff) | |
netlink: Fully clear parser state between messages
Failing to reset the cookie between messages can lead to an attempt
to interpret a zeroed buffer as a struct nlattr, causing a length
calculation to underflow, resulting in a memcpy() call where the
length exceeds the actual size of the buffer.
MFC after: 1 week
PR: 283797
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D51634
(cherry picked from commit a8d90e32133b77a49c2551f22e59f72d65293b64)
| -rw-r--r-- | sys/netlink/netlink_io.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/netlink/netlink_io.c b/sys/netlink/netlink_io.c index d33a3ace9e36..baa7e3350caf 100644 --- a/sys/netlink/netlink_io.c +++ b/sys/netlink/netlink_io.c @@ -454,6 +454,7 @@ static void npt_clear(struct nl_pstate *npt) { lb_clear(&npt->lb); + npt->cookie = NULL; npt->error = 0; npt->err_msg = NULL; npt->err_off = 0; |