diff options
| author | Vincenzo Maffione <vmaffione@FreeBSD.org> | 2026-04-29 20:59:17 +0000 |
|---|---|---|
| committer | Vincenzo Maffione <vmaffione@FreeBSD.org> | 2026-04-29 21:13:09 +0000 |
| commit | 0216ea8598af7d4170a8660f48981fb12b7b1d67 (patch) | |
| tree | 1ef27677eff4aac23b83f771db2dcd0a64e7014f /sys/dev | |
| parent | c5a92616c41f9132d585c533e66dee88e98c73f2 (diff) | |
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/netmap/netmap.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/dev/netmap/netmap.c b/sys/dev/netmap/netmap.c index f531151fb656..6f79c2c45b39 100644 --- a/sys/dev/netmap/netmap.c +++ b/sys/dev/netmap/netmap.c @@ -3503,6 +3503,7 @@ nmreq_copyin(struct nmreq_header *hdr, int nr_body_is_user) /* check optsz and nro_size to avoid for possible integer overflows of rqsz */ if ((optsz > NETMAP_REQ_MAXSIZE) || (opt->nro_size > NETMAP_REQ_MAXSIZE) || (rqsz + optsz > NETMAP_REQ_MAXSIZE) + || (p - ker + optsz > bufsz) || (optsz > 0 && rqsz + optsz <= rqsz)) { error = EMSGSIZE; goto out_restore; |