mirror of
https://github.com/opnsense/src.git
synced 2026-02-19 02:30:08 -05:00
ec2aaa9c70
The FW_ASYREQ ioctl accepts a struct fw_asyreq object as its argument, meaning that the kernel always copies in the full structure in sys_ioctl before passing the request down to the driver. However, fwcontrol was allocating smaller objects that contained only the request header and a variable-sized payload. This means that the kernel copy in sys_ioctl was reading off the end of this buffer. On current architectures this happened to be ok, but it is UB. Instead, allocate a full structure. Reported by: GCC 14 -Walloc-size Reviewed by: rlibby, brooks Differential Revision: https://reviews.freebsd.org/D46014 (cherry picked from commit 9494dfe1b3faf5c48abaa9be4ec87e4669963942) |
||
|---|---|---|
| .. | ||
| fwcontrol.8 | ||
| fwcontrol.c | ||
| fwdv.c | ||
| fwmethods.h | ||
| fwmpegts.c | ||
| Makefile | ||
| Makefile.depend | ||