diff options
| author | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2017-07-12 14:07:56 +0000 |
|---|---|---|
| committer | Alexander Bluhm <bluhm@cvs.openbsd.org> | 2017-07-12 14:07:56 +0000 |
| commit | d1d11fe79d4a9f5d39de9d734eae9153df86dbc9 (patch) | |
| tree | b728407a7a66cf9b93990901020c27147e071f79 /sys/net/pf_lb.c | |
| parent | 89c4152121d04a6ae02234eea51f1c1b0a8f2775 (diff) | |
Use a 32 bit variable to detect integer overflow when searching for
an unused nat port. Prevents a possible endless loop if high port
is 65535 or low port is 0.
report and analysis Jingmin Zhou; OK sashan@ visa@
Diffstat (limited to 'sys/net/pf_lb.c')
| -rw-r--r-- | sys/net/pf_lb.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/sys/net/pf_lb.c b/sys/net/pf_lb.c index 74acc538b8f..4b2ba0ddcd4 100644 --- a/sys/net/pf_lb.c +++ b/sys/net/pf_lb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf_lb.c,v 1.60 2017/04/23 11:37:11 sthen Exp $ */ +/* $OpenBSD: pf_lb.c,v 1.61 2017/07/12 14:07:55 bluhm Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -211,7 +211,7 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_rule *r, return (0); } } else { - u_int16_t tmp; + u_int32_t tmp; if (low > high) { tmp = low; @@ -221,7 +221,7 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_rule *r, /* low < high */ cut = arc4random_uniform(1 + high - low) + low; /* low <= cut <= high */ - for (tmp = cut; tmp <= high; ++(tmp)) { + for (tmp = cut; tmp <= high && tmp <= 0xffff; ++tmp) { key.port[sidx] = htons(tmp); if (pf_find_state_all(&key, dir, NULL) == NULL && !in_baddynamic(tmp, pd->proto)) { @@ -229,7 +229,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_rule *r, return (0); } } - for (tmp = cut - 1; tmp >= low; --(tmp)) { + tmp = cut; + for (tmp -= 1; tmp >= low && tmp <= 0xffff; --tmp) { key.port[sidx] = htons(tmp); if (pf_find_state_all(&key, dir, NULL) == NULL && !in_baddynamic(tmp, pd->proto)) { |