mirror of
https://github.com/opnsense/src.git
synced 2026-07-15 20:13:02 -04:00
f7230ff357
In alias_rtsp_out(), we construct a new packet in a fixed-length buffer before copying it back into the original buffer. We never checked if the data we were writing to this temporary buffer fit in it, nor if the result fit in the original buffer. * Use a dynamically sized allocated buffer instead of a fixed-length stack buffer. * Check for overflow before appending to our temporary buffer. * Check for overflow before copying the data back to the packet buffer. * While here, use size_t for sizes and bool for booleans. Approved by: so Security: FreeBSD-SA-26:41.libalias Security: CVE-2026-49420 MFC after: 1 week Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D57753 |
||
|---|---|---|
| .. | ||
| alias.c | ||
| alias.h | ||
| alias_db.c | ||
| alias_db.h | ||
| alias_dummy.c | ||
| alias_ftp.c | ||
| alias_irc.c | ||
| alias_local.h | ||
| alias_mod.c | ||
| alias_mod.h | ||
| alias_nbt.c | ||
| alias_pptp.c | ||
| alias_proxy.c | ||
| alias_sctp.c | ||
| alias_sctp.h | ||
| alias_skinny.c | ||
| alias_smedia.c | ||
| alias_util.c | ||
| HISTORY | ||
| libalias.3 | ||