mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-31 21:06:18 +01:00
Andrew Griffiths
3be409a395
The security.mac.bsdextended.rules.<N> node handler takes N as
`index = name[0]` (a signed int) and only checks
`index >= MAC_BSDEXTENDED_MAXRULES`. A negative index is caught on
the read branch, but the write-only add and delete
branches proceed to `rules[index]` unconditionally.
Reject `index < 0` alongside the existing upper-bound check.
Submitted by calif.io for the OpenAI Patch The Planet program
Signed-off-by: Andrew Griffiths <[email protected]>
Reviewed by: markj
MFC after: 2 weeks
(cherry picked from commit 5d0b87669a)