aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2006-01-25 10:00:40 +0000
committerColin Percival <cperciva@FreeBSD.org>2006-01-25 10:00:40 +0000
commit02d4ab93fb7545debdb2a8e9f68bb481e7623e6a (patch)
treea93691f1612b440ad20be0c156aede2d28990c7f
parentdf59a0fee7a181161b8e3806744ad78b6d30bec4 (diff)
downloadsrc-02d4ab93fb7545debdb2a8e9f68bb481e7623e6a.tar.gz
src-02d4ab93fb7545debdb2a8e9f68bb481e7623e6a.zip
Make sure buffers in if_bridge are fully initialized before copying
them to userland. Security: FreeBSD-SA-06:06.kmem
Notes
Notes: svn path=/head/; revision=154806
-rw-r--r--sys/net/if_bridge.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 1b0875b22621..69dc4662ac91 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -615,6 +615,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
break;
}
+ bzero(&args, sizeof args);
if (bc->bc_flags & BC_F_COPYIN) {
error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
if (error)
@@ -1022,6 +1023,7 @@ bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
count = 0;
len = bifc->ifbic_len;
+ bzero(&breq, sizeof breq);
LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
if (len < sizeof(breq))
break;
@@ -1075,6 +1077,7 @@ bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
return (0);
len = bac->ifbac_len;
+ bzero(&bareq, sizeof bareq);
LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
if (len < sizeof(bareq))
goto out;