aboutsummaryrefslogtreecommitdiff
path: root/sbin
diff options
context:
space:
mode:
authorJessica Clarke <jrtc27@FreeBSD.org>2022-05-22 08:31:42 +0000
committerKristof Provost <kp@FreeBSD.org>2022-05-22 08:31:42 +0000
commit298663855015c1eba7ccf5b88168f433653eb609 (patch)
tree31b3be28fbbfb99cb04d2d438879aa871c06a4e6 /sbin
parentd94358e29d1eacab17e9992ad91decb1b84b9449 (diff)
downloadsrc-298663855015c1eba7ccf5b88168f433653eb609.tar.gz
src-298663855015c1eba7ccf5b88168f433653eb609.zip
pfctl: fix out-of-bounds access
If pfctl is called with "pfctl -a ''" we read outside of the anchoropt buffer. Check that the buffer is sufficiently long to avoid that. Maintain the existing (and desired, because it's used as such in /etc/periodic/security/520.pfdenied) behaviour of treating "-a ''" as a request for the root anchor (or no anchor specified). PR: 264128 Reviewed by: kp
Diffstat (limited to 'sbin')
-rw-r--r--sbin/pfctl/pfctl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c
index a1f8e5fedd4c..93d26e53d71d 100644
--- a/sbin/pfctl/pfctl.c
+++ b/sbin/pfctl/pfctl.c
@@ -2864,7 +2864,7 @@ main(int argc, char *argv[])
if (anchoropt != NULL) {
int len = strlen(anchoropt);
- if (anchoropt[len - 1] == '*') {
+ if (len >= 1 && anchoropt[len - 1] == '*') {
if (len >= 2 && anchoropt[len - 2] == '/')
anchoropt[len - 2] = '\0';
else