bounds check on afswitch array

SCCS-vsn: sys/net/if.c 4.15
SCCS-vsn: sys/net/route.c 4.7

diff --git a/usr/src/sys/net/if.c b/usr/src/sys/net/if.c
index ee6ef4f..095a620 100644 (file)
--- a/usr/src/sys/net/if.c
+++ b/usr/src/sys/net/if.c
@@ -1,4 +1,4 @@
-/*     if.c    4.14    82/04/24        */
+/*     if.c    4.15    82/05/04        */

 
 #include "../h/param.h"
 #include "../h/systm.h"
 
 #include "../h/param.h"
 #include "../h/systm.h"


@@ -94,8 +94,11 @@ if_ifwithnet(addr)
 {
        register struct ifnet *ifp;
        register int af = addr->sa_family;
 {
        register struct ifnet *ifp;
        register int af = addr->sa_family;

-       register int (*netmatch)() = afswitch[af].af_netmatch;
+       register int (*netmatch)();

 
 

+       if (af >= AF_MAX)
+               return (0);
+       netmatch = afswitch[af].af_netmatch;

        for (ifp = ifnet; ifp; ifp = ifp->if_next) {
                if (af != ifp->if_addr.sa_family)
                        continue;
        for (ifp = ifnet; ifp; ifp = ifp->if_next) {
                if (af != ifp->if_addr.sa_family)
                        continue;

diff --git a/usr/src/sys/net/route.c b/usr/src/sys/net/route.c
index f9b9e23..06be927 100644 (file)
--- a/usr/src/sys/net/route.c
+++ b/usr/src/sys/net/route.c
@@ -1,4 +1,4 @@
-/*     route.c 4.6     82/03/31        */
+/*     route.c 4.7     82/05/04        */

 
 #include "../h/param.h"
 #include "../h/systm.h"
 
 #include "../h/param.h"
 #include "../h/systm.h"


@@ -30,6 +30,8 @@ rtalloc(ro)
 COUNT(RTALLOC);
        if (ro->ro_rt && ro->ro_rt->rt_ifp)                     /* XXX */
                return;
 COUNT(RTALLOC);
        if (ro->ro_rt && ro->ro_rt->rt_ifp)                     /* XXX */
                return;

+       if (af >= AF_MAX)
+               return;

        (*afswitch[af].af_hash)(dst, &h);
        rtmin = 0, hash = h.afh_hosthash;
        for (m = rthost[hash % RTHASHSIZ]; m; m = m->m_next) {
        (*afswitch[af].af_hash)(dst, &h);
        rtmin = 0, hash = h.afh_hosthash;
        for (m = rthost[hash % RTHASHSIZ]; m; m = m->m_next) {


@@ -92,6 +94,8 @@ rtrequest(req, new)
        int af = sa->sa_family, doinghost, s, error = 0;
 
 COUNT(RTREQUEST);
        int af = sa->sa_family, doinghost, s, error = 0;
 
 COUNT(RTREQUEST);

+       if (af >= AF_MAX)
+               return (EAFNOSUPPORT);

        (*afswitch[af].af_hash)(sa, &h);
        hash = h.afh_hosthash;
        mprev = &rthost[hash % RTHASHSIZ];
        (*afswitch[af].af_hash)(sa, &h);
        hash = h.afh_hosthash;
        mprev = &rthost[hash % RTHASHSIZ];