From ae4f39464c61182c2bdfd3cc61594f8707b3daf0 Mon Sep 17 00:00:00 2001 From: Ed Maste Date: Tue, 1 Nov 2022 10:01:29 -0400 Subject: [PATCH] ng_parse: disallow negative length for malloc This is an interim robustness improvement; further improvements as described in the PR and/or Phabricator review are still needed. PR: 267334 Reported by: Robert Morris Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D37229 --- sys/netgraph/ng_parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/netgraph/ng_parse.c b/sys/netgraph/ng_parse.c index e1107027448..1a1d9d8b306 100644 --- a/sys/netgraph/ng_parse.c +++ b/sys/netgraph/ng_parse.c @@ -1207,6 +1207,8 @@ ng_parse_composite(const struct ng_parse_type *type, const char *s, int align, len, blen, error = 0; /* Initialize */ + if (num < 0) + return (EINVAL); foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO); if (foff == NULL) { error = ENOMEM;