mirror of
https://github.com/opnsense/src.git
synced 2026-04-02 16:05:17 -04:00
pfioctl() handles several ioctl that takes variable length input, these include: - DIOCRADDTABLES - DIOCRDELTABLES - DIOCRGETTABLES - DIOCRGETTSTATS - DIOCRCLRTSTATS - DIOCRSETTFLAGS All of them take a pfioc_table struct as input from userland. One of its elements (pfrio_size) is used in a buffer length calculation. The calculation contains an integer overflow which if triggered can lead to out of bound reads and writes later on. Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> |
||
|---|---|---|
| .. | ||
| if_pflog.c | ||
| if_pfsync.c | ||
| in4_cksum.c | ||
| pf.c | ||
| pf.h | ||
| pf_altq.h | ||
| pf_if.c | ||
| pf_ioctl.c | ||
| pf_lb.c | ||
| pf_mtag.h | ||
| pf_norm.c | ||
| pf_osfp.c | ||
| pf_ruleset.c | ||
| pf_table.c | ||