diff options
| author | Dag-Erling Smørgrav <des@FreeBSD.org> | 2025-07-31 10:06:47 +0000 |
|---|---|---|
| committer | Dag-Erling Smørgrav <des@FreeBSD.org> | 2025-08-06 13:52:14 +0000 |
| commit | f318186deb3ef3b90104e8372563e80c9358183e (patch) | |
| tree | fb764784ea0ff7100999765bb8055a88ea751e8a /sbin/dhclient/parse.c | |
| parent | aadc10e7ce1a8bb47cd628a2111b71fac3684915 (diff) | |
netlink: Fully clear parser state between messagesstable/13
Failing to reset the cookie between messages can lead to an attempt
to interpret a zeroed buffer as a struct nlattr, causing a length
calculation to underflow, resulting in a memcpy() call where the
length exceeds the actual size of the buffer.
MFC after: 1 week
PR: 283797
Reviewed by: glebius
Differential Revision: https://reviews.freebsd.org/D51634
(cherry picked from commit a8d90e32133b77a49c2551f22e59f72d65293b64)
Diffstat (limited to 'sbin/dhclient/parse.c')
0 files changed, 0 insertions, 0 deletions