mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
Andrew Griffiths
5d0b87669a
The security.mac.bsdextended.rules.<N> node handler takes N as `index = name[0]` (a signed int) and only checks `index >= MAC_BSDEXTENDED_MAXRULES`. A negative index is caught on the read branch, but the write-only add and delete branches proceed to `rules[index]` unconditionally. Reject `index < 0` alongside the existing upper-bound check. Submitted by calif.io for the OpenAI Patch The Planet program Signed-off-by: Andrew Griffiths <[email protected]> Reviewed by: markj MFC after: 2 weeks