svn commit: r350865 - stable/11/sys/net

[George V. Neville-Neil]

Author: gnn
Date: Sun Aug 11 20:34:24 2019
New Revision: 350865
URL: https://svnweb.freebsd.org/changeset/base/350865

Log:
  MFC: 350557
  
  Properly validate arguments for route deletion
  
  Reported by: Liang Zhuo brightiup.zhuo at gmail.com

Modified:
  stable/11/sys/net/route.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/net/route.c
==============================================================================
--- stable/11/sys/net/route.c	Sun Aug 11 20:34:16 2019	(r350864)
+++ stable/11/sys/net/route.c	Sun Aug 11 20:34:24 2019	(r350865)
@@ -1612,6 +1612,8 @@ rtrequest1_fib(int req, struct rt_addrinfo *info, stru
 	switch (req) {
 	case RTM_DELETE:
 		if (netmask) {
+			if (dst->sa_len > sizeof(mdst))
+				return (EINVAL);
 			rt_maskedcopy(dst, (struct sockaddr *)&mdst, netmask);
 			dst = (struct sockaddr *)&mdst;
 		}