From dc3ee89c86d30cc7a14dce9550bbd4d37c7ff182 Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Wed, 5 Jun 2024 17:55:37 -0400 Subject: [PATCH] pfctl: fix possible out-of-bounds read Tags in $10 (filter_opts) are not guaranteed to be the maximum possible tag length, so memcpy() can end up reading outside of the allocated buffer. Use strlcpy() instead. Reported by: CheriBSD Event: Kitchener-Waterloo Hackathon 202406 --- sbin/pfctl/parse.y | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index 92e6e36f3b23..19e029c881d1 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -1230,7 +1230,7 @@ etherrule : ETHER action dir quick interface bridge etherproto etherfromto l3fro r.direction = $3; r.quick = $4.quick; if ($10.tag != NULL) - memcpy(&r.tagname, $10.tag, sizeof(r.tagname)); + strlcpy(r.tagname, $10.tag, sizeof(r.tagname)); if ($10.match_tag) if (strlcpy(r.match_tagname, $10.match_tag, PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { @@ -1240,7 +1240,7 @@ etherrule : ETHER action dir quick interface bridge etherproto etherfromto l3fro } r.match_tag_not = $10.match_tag_not; if ($10.queues.qname != NULL) - memcpy(&r.qname, $10.queues.qname, sizeof(r.qname)); + strlcpy(r.qname, $10.queues.qname, sizeof(r.qname)); r.dnpipe = $10.dnpipe; r.dnflags = $10.free_flags; if (eth_rule_label(&r, $10.label))