diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-02-23 15:52:50 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-02-24 15:58:48 +0000 |
| commit | f3be7df50f01d9a6ead9f27b55bb4dfd7dc4f9d2 (patch) | |
| tree | c5c36171e7aec161eff8e557c968262f0c1e5246 | |
| parent | 0ff08b8c402b3c555125e4c72df0b80b4d084d56 (diff) | |
rtsock: Fix stack overflow
Approved by: so
Security: FreeBSD-SA-26:05.route
Security: CVE-2026-3038
Fixes: 92be2847e845 ("rtsock: Avoid copying uninitialized padding bytes")
| -rw-r--r-- | sys/net/rtsock.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c index 774537366910..5251d4d75f15 100644 --- a/sys/net/rtsock.c +++ b/sys/net/rtsock.c @@ -1875,8 +1875,8 @@ rtsock_msg_buffer(int type, struct rt_addrinfo *rtinfo, struct walkarg *w, int * #endif dlen = SA_SIZE(sa); if (cp != NULL && buflen >= dlen) { - KASSERT(dlen <= sizeof(ss), - ("%s: sockaddr size overflow", __func__)); + if (sa->sa_len > sizeof(ss)) + return (EINVAL); bzero(&ss, sizeof(ss)); bcopy(sa, &ss, sa->sa_len); sa = (struct sockaddr *)&ss; |