imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 19:34:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

pfctl: fix anchortypes bounds test

Browse Source 
found by "buffer overflow 'anchortypes' 10 <= 12" smatch error
feedback and ok sashan@, ok miod@ on an earlier version

Obtained from:	OpenBSD, jsg <[email protected]>, 730c5d0121
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost committed 2025-09-15 11:32:33 +02:00
1 parent 4894f5ba39
commit c2d03a920e
1 file changed
+15 -14
Download Patch File Download Diff File Expand all files Collapse all files
sbin/pfctl/pfctl_parser.c
+15 -14
View File
@@ -853,21 +853,22 @@ print_rule(struct pfctl_rule *r, const char *anchor_call, int verbose, int numer
if (verbose)
printf("@%d ", r->nr);
if (r->action == PF_MATCH)
printf("match");
else if (r->action > PF_NORDR)
printf("action(%d)", r->action);
else if (anchor_call[0]) {
p = strrchr(anchor_call, '/');
if (p ? p[1] == '_' : anchor_call[0] == '_')
printf("%s", anchortypes[r->action]);
else
printf("%s \"%s\"", anchortypes[r->action],
anchor_call);
if (anchor_call[0]) {
if (r->action >= nitems(anchortypes)) {
printf("anchor(%d)", r->action);
} else {
p = strrchr(anchor_call, '/');
if (p ? p[1] == '_' : anchor_call[0] == '_')
printf("%s", anchortypes[r->action]);
else
printf("%s \"%s\"", anchortypes[r->action],
anchor_call);
}
} else {
printf("%s", actiontypes[r->action]);
if (r->natpass)
printf(" pass");
if (r->action >= nitems(actiontypes))
printf("action(%d)", r->action);
else
printf("%s", actiontypes[r->action]);
}
if (r->action == PF_DROP) {
if (r->rule_flag & PFRULE_RETURN)