From d8dc4e350f47d8a787a22dd848197352b8613fed Mon Sep 17 00:00:00 2001 From: "George V. Neville-Neil" Date: Sat, 3 Aug 2019 14:42:07 +0000 Subject: [PATCH] Properly validte arguments for route deletion Reported by: Liang Zhuo brightiup.zhuo@gmail.com MFC after: 1 week --- sys/net/route.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/net/route.c b/sys/net/route.c index 85a4f426450..1dd12da6ded 100644 --- a/sys/net/route.c +++ b/sys/net/route.c @@ -1590,6 +1590,8 @@ rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt, switch (req) { case RTM_DELETE: if (netmask) { + if (dst->sa_len > sizeof(mdst)) + return (EINVAL); rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask); dst = (struct sockaddr *)&mdst; }