svn commit: r237154 - projects/pf/head/sys/contrib/pf/net

[Gleb Smirnoff]

Author: glebius
Date: Sat Jun 16 05:06:43 2012
New Revision: 237154
URL: http://svn.freebsd.org/changeset/base/237154

Log:
  Fix off-by-one overflow in the copyout() for the DIOCIGETIFACES ioctl.

Modified:
  projects/pf/head/sys/contrib/pf/net/pf_ioctl.c

Modified: projects/pf/head/sys/contrib/pf/net/pf_ioctl.c
==============================================================================
--- projects/pf/head/sys/contrib/pf/net/pf_ioctl.c	Sat Jun 16 04:41:35 2012	(r237153)
+++ projects/pf/head/sys/contrib/pf/net/pf_ioctl.c	Sat Jun 16 05:06:43 2012	(r237154)
@@ -3248,19 +3248,19 @@ DIOCCHANGEADDR_error:
 	case DIOCIGETIFACES: {
 		struct pfioc_iface *io = (struct pfioc_iface *)addr;
 		struct pfi_kif *ifstore;
+		size_t bufsiz;
 
 		if (io->pfiio_esize != sizeof(struct pfi_kif)) {
 			error = ENODEV;
 			break;
 		}
 
-		ifstore = malloc(io->pfiio_size * sizeof(struct pfi_kif),
-		    M_TEMP, M_WAITOK);
+		bufsiz = io->pfiio_size * sizeof(struct pfi_kif);
+		ifstore = malloc(bufsiz, M_TEMP, M_WAITOK);
 		PF_RULES_RLOCK();
 		pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size);
 		PF_RULES_RUNLOCK();
-		error = copyout(ifstore, io->pfiio_buffer, io->pfiio_size *
-		    sizeof(struct pfi_kif));
+		error = copyout(ifstore, io->pfiio_buffer, bufsiz);
 		free(ifstore, M_TEMP);
 		break;
 	}