diff options
| author |   bluhm <bluhm@openbsd.org> | 2017-07-12 14:07:55 +0000 |
|---|---|---|
| committer | bluhm <bluhm@openbsd.org> | 2017-07-12 14:07:55 +0000 |
| commit | 425f1cf27b3247d066477dc1da3914abe13420c0 (patch) | |
| tree | 6dd4806710d3d06a95ecc4ffc739d06bf7392e66 | |
| parent | Prefer paravirtualized interface for IDE disks as well (diff) | |
| download | wireguard-openbsd-425f1cf27b3247d066477dc1da3914abe13420c0.tar.xz wireguard-openbsd-425f1cf27b3247d066477dc1da3914abe13420c0.zip | |
Use a 32 bit variable to detect integer overflow when searching for
an unused nat port. Prevents a possible endless loop if high port
is 65535 or low port is 0.
report and analysis Jingmin Zhou; OK sashan@ visa@
| -rw-r--r-- | sys/net/pf_lb.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/sys/net/pf_lb.c b/sys/net/pf_lb.c index 74acc538b8f..4b2ba0ddcd4 100644 --- a/sys/net/pf_lb.c +++ b/sys/net/pf_lb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf_lb.c,v 1.60 2017/04/23 11:37:11 sthen Exp $ */ +/* $OpenBSD: pf_lb.c,v 1.61 2017/07/12 14:07:55 bluhm Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -211,7 +211,7 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_rule *r, return (0); } } else { - u_int16_t tmp; + u_int32_t tmp; if (low > high) { tmp = low; @@ -221,7 +221,7 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_rule *r, /* low < high */ cut = arc4random_uniform(1 + high - low) + low; /* low <= cut <= high */ - for (tmp = cut; tmp <= high; ++(tmp)) { + for (tmp = cut; tmp <= high && tmp <= 0xffff; ++tmp) { key.port[sidx] = htons(tmp); if (pf_find_state_all(&key, dir, NULL) == NULL && !in_baddynamic(tmp, pd->proto)) { @@ -229,7 +229,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_rule *r, return (0); } } - for (tmp = cut - 1; tmp >= low; --(tmp)) { + tmp = cut; + for (tmp -= 1; tmp >= low && tmp <= 0xffff; --tmp) { key.port[sidx] = htons(tmp); if (pf_find_state_all(&key, dir, NULL) == NULL && !in_baddynamic(tmp, pd->proto)) { |