diff options
| author | Zhenlei Huang <zlei@FreeBSD.org> | 2025-12-29 14:20:12 +0000 |
|---|---|---|
| committer | Zhenlei Huang <zlei@FreeBSD.org> | 2025-12-29 14:20:12 +0000 |
| commit | 85f499be90c15a3de02d1c62ce03b99fab52f925 (patch) | |
| tree | 764e33a3588e312a8d66e772153010a558de34a0 | |
| parent | faff7013187b03f4240af6f52f608e7ebafe19f3 (diff) | |
qlnxe: Avoid out-of-bounds reading the multicast ethernet address
The correct length of an ethernet address is ETHER_ADDR_LEN but not
ETHER_HDR_LEN.
MFC after: 1 week
| -rw-r--r-- | sys/dev/qlnx/qlnxe/qlnx_os.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/dev/qlnx/qlnxe/qlnx_os.c b/sys/dev/qlnx/qlnxe/qlnx_os.c index 9963f472c615..99110e5e2d8f 100644 --- a/sys/dev/qlnx/qlnxe/qlnx_os.c +++ b/sys/dev/qlnx/qlnxe/qlnx_os.c @@ -2539,7 +2539,7 @@ qlnx_hw_set_multi(qlnx_host_t *ha, uint8_t *mta, uint32_t mcnt, break; } - mta += ETHER_HDR_LEN; + mta += ETHER_ADDR_LEN; } return; } @@ -2552,7 +2552,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt) if (mcnt == QLNX_MAX_NUM_MULTICAST_ADDRS) return (0); - bcopy(LLADDR(sdl), &mta[mcnt * ETHER_HDR_LEN], ETHER_HDR_LEN); + bcopy(LLADDR(sdl), &mta[mcnt * ETHER_ADDR_LEN], ETHER_ADDR_LEN); return (1); } @@ -2560,7 +2560,7 @@ qlnx_copy_maddr(void *arg, struct sockaddr_dl *sdl, u_int mcnt) static int qlnx_set_multi(qlnx_host_t *ha, uint32_t add_multi) { - uint8_t mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_HDR_LEN]; + uint8_t mta[QLNX_MAX_NUM_MULTICAST_ADDRS * ETHER_ADDR_LEN]; if_t ifp = ha->ifp; u_int mcnt; |