aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGleb Smirnoff <glebius@FreeBSD.org>2025-01-29 23:40:56 +0000
committerGleb Smirnoff <glebius@FreeBSD.org>2025-01-29 23:48:55 +0000
commitcdacb12065e4d85416655743da5bc6b17a9d9119 (patch)
tree83525b3aaa740dd7e44d58a352a9ef2ea84213d7
parent031fbf8dc962ca8d458b217ba2b4a9e637b7e932 (diff)
netlink/route: validate family attribute
PR: 283818
-rw-r--r--sys/netlink/route/rt.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/netlink/route/rt.c b/sys/netlink/route/rt.c
index 9750ad9d0649..30dab2b0d8cf 100644
--- a/sys/netlink/route/rt.c
+++ b/sys/netlink/route/rt.c
@@ -955,7 +955,7 @@ rtnl_handle_newroute(struct nlmsghdr *hdr, struct nlpcb *nlp,
/* pre-2.6.19 Linux API compatibility */
if (attrs.rtm_table > 0 && attrs.rta_table == 0)
attrs.rta_table = attrs.rtm_table;
- if (attrs.rta_table >= V_rt_numfibs) {
+ if (attrs.rta_table >= V_rt_numfibs || attrs.rtm_family > AF_MAX) {
NLMSG_REPORT_ERR_MSG(npt, "invalid fib");
return (EINVAL);
}
@@ -1018,7 +1018,7 @@ rtnl_handle_delroute(struct nlmsghdr *hdr, struct nlpcb *nlp,
return (ESRCH);
}
- if (attrs.rta_table >= V_rt_numfibs) {
+ if (attrs.rta_table >= V_rt_numfibs || attrs.rtm_family > AF_MAX) {
NLMSG_REPORT_ERR_MSG(npt, "invalid fib");
return (EINVAL);
}
@@ -1041,7 +1041,7 @@ rtnl_handle_getroute(struct nlmsghdr *hdr, struct nlpcb *nlp, struct nl_pstate *
if (error != 0)
return (error);
- if (attrs.rta_table >= V_rt_numfibs) {
+ if (attrs.rta_table >= V_rt_numfibs || attrs.rtm_family > AF_MAX) {
NLMSG_REPORT_ERR_MSG(npt, "invalid fib");
return (EINVAL);
}