The routing table index rtableid has type unsigned int in the routing

code.  In pf rtableid == -1 means don't change the rtableid because
of this rule.  So it has to be signed int there.  Before the value
is passed from pf to route it is always checked to be >= 0.  Change
the type to int in pf and to u_int in netinet and netinet6 to make
the checks work.  Otherwise -1 may be used as an array index and
the kernel crashes.

ok henning@

1 files changed, 2 insertions, 2 deletions

diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 9952de3cf69..d60d52983c4 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfvar.h,v 1.285 2009/04/06 12:05:55 henning Exp $ */
+/*	$OpenBSD: pfvar.h,v 1.286 2009/05/18 20:37:13 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -796,7 +796,7 @@ struct pf_state {
 	/* XXX */
 	u_int8_t		 sync_updates;
 
-	int16_t			 rtableid;
+	int			 rtableid;
 	u_int8_t		 min_ttl;
 	u_int8_t		 set_tos;
 	u_int16_t		 max_mss;