imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

ipfilter: fix inverted range check on the lookup iterator unit

Browse Source 
ipf_lookup_iterate() validates iter.ili_unit with

  if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX)

or alternatively,

  if (iter.ili_unit < -1 && iter.ili_unit > 7)

ipf_lookup_add(), ipf_lookup_delete(), ipf_lookup_stats()
ipf_lookup_flush() validate with a ||

Submitted by calif.io for the OpenAI Patch The Planet program

Signed-off-by: Andrew Griffiths <[email protected]>

Reviewed by:	markj
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D59726
This commit is contained in:
Andrew Griffiths authored and Mark Johnston committed 2026-09-25 16:50:42 +00:00
1 parent 4523cbbfef
commit cb035c19c3
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
sys/netpfil/ipfilter/netinet/ip_lookup.c
+1 -1
View File
@@ -663,7 +663,7 @@ ipf_lookup_iterate(ipf_main_softc_t *softc, void *data, int uid, void *ctx)
if (err != 0)
return (err);
if (iter.ili_unit < IPL_LOGALL && iter.ili_unit > IPL_LOGMAX) {
if (iter.ili_unit < IPL_LOGALL || iter.ili_unit > IPL_LOGMAX) {
IPFERROR(50038);
return (EINVAL);
}