From 51b159306584004fc4d4fba87d64d85f73007491 Mon Sep 17 00:00:00 2001 From: "Andrey V. Elsukov" Date: Tue, 15 Oct 2019 09:50:02 +0000 Subject: [PATCH] Explicitly initialize the memory buffer to store O_ICMP6TYPE opcode. By default next_cmd() initializes only first u32 of opcode. O_ICMP6TYPE opcode has array of bit masks to store corresponding ICMPv6 types. An opcode that precedes O_ICMP6TYPE, e.g. O_IP6_DST, can have variable length and during opcode filling it can modify memory that will be used by O_ICMP6TYPE opcode. Without explicit initialization this leads to creation of wrong opcode. Reported by: Boris N. Lytochkin Obtained from: Yandex LLC MFC after: 3 days --- sbin/ipfw/ipv6.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sbin/ipfw/ipv6.c b/sbin/ipfw/ipv6.c index 7f30a1df7bc..050cb6d4294 100644 --- a/sbin/ipfw/ipv6.c +++ b/sbin/ipfw/ipv6.c @@ -143,6 +143,7 @@ fill_icmp6types(ipfw_insn_icmp6 *cmd, char *av, int cblen) uint8_t type; CHECK_LENGTH(cblen, F_INSN_SIZE(ipfw_insn_icmp6)); + memset(cmd, 0, sizeof(*cmd)); while (*av) { if (*av == ',') av++;