ng_parse: Add upper bound to avoid possible overflow

Also move num initialization for clarity.

We still need to check num in ng_unparse_composite (reported by des@ in
D52151) but this is another incremental improvement in netgraph input
validation.

Reviewed by:	des
PR:		267334
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52151

This commit is contained in:

Ed Maste

2025-08-25 10:25:13 -04:00

parent 21628c79d5

commit 375527545c

1 changed files with 2 additions and 2 deletions

									
										sys/netgraph/ng_parse.c
									
		+2
		-2
	
												View File
												
				@@ -1199,14 +1199,14 @@ ng_parse_composite(const struct ng_parse_type *type, const char *s,

					int *off, const u_char *const start, u_char *const buf, int *buflen,

					const enum comptype ctype)

				{

					const int num = ng_get_composite_len(type, start, buf, ctype);

					int nextIndex = 0;		/* next implicit array index */

					u_int index;			/* field or element index */

					int *foff;			/* field value offsets in string */

					int align, len, blen, error = 0;

					/* Initialize */

					if (num < 0)

					const int num = ng_get_composite_len(type, start, buf, ctype);

					if (num < 0 || num > INT_MAX / sizeof(*foff))

						return (EINVAL);

					foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO);

					if (foff == NULL) {