diff options
| author | Lutz Donnerhacke <donner@FreeBSD.org> | 2021-01-02 13:58:17 +0000 |
|---|---|---|
| committer | Lutz Donnerhacke <donner@FreeBSD.org> | 2021-02-01 14:07:31 +0000 |
| commit | 90d158c0cf2598fde2ea1c7cd58909cf5a21c471 (patch) | |
| tree | 8bf695ff0ae04ea26ef3443b3615d7237e1f58af /sys/netgraph/ng_tag.c | |
| parent | 671c393854a5ae60369beadfb74007e240bb18ab (diff) | |
| download | src-90d158c0cf2598fde2ea1c7cd58909cf5a21c471.tar.gz src-90d158c0cf2598fde2ea1c7cd58909cf5a21c471.zip | |
netgraph/ng_tag: permit variable length data
ng_tag(4) operate on arbitrary data of mbuf_tags(9). Those structures
are padded to the next multiple of the alignment by the compiler.
Hence a valid argument has be at most as long as the data received.
PR: 241462
Reviewed by: kp
Approved by: philip (mentor)
Differential Revision: https://reviews.freebsd.org/D22140
(cherry picked from commit 7c7c231c14246a709270bf3f3a4593208e84d01a)
Diffstat (limited to 'sys/netgraph/ng_tag.c')
| -rw-r--r-- | sys/netgraph/ng_tag.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/sys/netgraph/ng_tag.c b/sys/netgraph/ng_tag.c index 22d45a3174ad..1a9d44528a24 100644 --- a/sys/netgraph/ng_tag.c +++ b/sys/netgraph/ng_tag.c @@ -361,9 +361,8 @@ ng_tag_rcvmsg(node_p node, item_p item, hook_p lasthook) hook_p hook; /* Sanity check. */ - if (msg->header.arglen < sizeof(*hp) - || msg->header.arglen != - NG_TAG_HOOKIN_SIZE(hp->tag_len)) + if (msg->header.arglen < sizeof(*hp) || + msg->header.arglen < NG_TAG_HOOKIN_SIZE(hp->tag_len)) ERROUT(EINVAL); /* Find hook. */ @@ -383,9 +382,8 @@ ng_tag_rcvmsg(node_p node, item_p item, hook_p lasthook) hook_p hook; /* Sanity check. */ - if (msg->header.arglen < sizeof(*hp) - || msg->header.arglen != - NG_TAG_HOOKOUT_SIZE(hp->tag_len)) + if (msg->header.arglen < sizeof(*hp) || + msg->header.arglen < NG_TAG_HOOKOUT_SIZE(hp->tag_len)) ERROUT(EINVAL); /* Find hook. */ |