Author: loos Date: Thu Aug 20 14:03:03 2015 New Revision: 286961 URL: https://svnweb.freebsd.org/changeset/base/286961
Log: MFC r286862: Fix the copy of addresses passed from userland in table replace command. The size2 is the maximum userland buffer size (used when the addresses are copied back to userland). Obtained from: pfSense Sponsored by: Rubicon Communications (Netgate) Modified: stable/10/sys/netpfil/pf/pf_ioctl.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/netpfil/pf/pf_ioctl.c ============================================================================== --- stable/10/sys/netpfil/pf/pf_ioctl.c Thu Aug 20 13:37:08 2015 (r286960) +++ stable/10/sys/netpfil/pf/pf_ioctl.c Thu Aug 20 14:03:03 2015 (r286961) @@ -2718,8 +2718,7 @@ DIOCCHANGEADDR_error: error = ENODEV; break; } - totlen = (io->pfrio_size + io->pfrio_size2) * - sizeof(struct pfr_addr); + totlen = io->pfrio_size * sizeof(struct pfr_addr); pfras = malloc(totlen, M_TEMP, M_WAITOK); error = copyin(io->pfrio_buffer, pfras, totlen); if (error) { _______________________________________________ svn-src-stable-10@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10 To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"