[src/netbsd-8]: src/sys/net Pull up following revision(s) (requested by riast...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d02a2eb1022f
branches:  netbsd-8
changeset: 373638:d02a2eb1022f
user:      martin <martin%NetBSD.org@localhost>
date:      Wed Feb 22 19:51:47 2023 +0000

description:
Pull up following revision(s) (requested by riastradh in ticket #1802):

        sys/net/bpf.c: revision 1.247 (manually merged)

bpf(4): Reject bogus timeout values before arithmetic overflows.

diffstat:

 sys/net/bpf.c |  26 ++++++++++++++++++++++----
 1 files changed, 22 insertions(+), 4 deletions(-)

diffs (54 lines):

diff -r d1978bc012f2 -r d02a2eb1022f sys/net/bpf.c
--- a/sys/net/bpf.c     Wed Feb 22 19:32:22 2023 +0000
+++ b/sys/net/bpf.c     Wed Feb 22 19:51:47 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bpf.c,v 1.216.6.7 2019/08/04 11:19:03 martin Exp $     */
+/*     $NetBSD: bpf.c,v 1.216.6.8 2023/02/22 19:51:47 martin Exp $     */
 
 /*
  * Copyright (c) 1990, 1991, 1993
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.216.6.7 2019/08/04 11:19:03 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.216.6.8 2023/02/22 19:51:47 martin Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_bpf.h"
@@ -1091,7 +1091,16 @@
                        struct timeval *tv = addr;
 
                        /* Compute number of ticks. */
-                       d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
+                       if (tv->tv_sec < 0 ||
+                           tv->tv_usec < 0 || tv->tv_usec >= 1000000) {
+                               error = EINVAL;
+                               break;
+                       } else if (tv->tv_sec > INT_MAX/hz - 1) {
+                               d->bd_rtout = INT_MAX;
+                       } else {
+                               d->bd_rtout = tv->tv_sec * hz
+                                   + tv->tv_usec / tick;
+                       }
                        if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
                                d->bd_rtout = 1;
                        break;
@@ -1120,7 +1129,16 @@
                        struct timeval50 *tv = addr;
 
                        /* Compute number of ticks. */
-                       d->bd_rtout = tv->tv_sec * hz + tv->tv_usec / tick;
+                       if (tv->tv_sec < 0 ||
+                           tv->tv_usec < 0 || tv->tv_usec >= 1000000) {
+                               error = EINVAL;
+                               break;
+                       } else if (tv->tv_sec > INT_MAX/hz - 1) {
+                               d->bd_rtout = INT_MAX;
+                       } else {
+                               d->bd_rtout = tv->tv_sec * hz
+                                   + tv->tv_usec / tick;
+                       }
                        if ((d->bd_rtout == 0) && (tv->tv_usec != 0))
                                d->bd_rtout = 1;
                        break;