diff options
| author | Jason A. Donenfeld <Jason@zx2c4.com> | 2021-04-19 15:10:23 -0600 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2021-04-19 15:10:23 -0600 |
| commit | 3625f8d2843b37408d44a5a28654ba7c323b77ea (patch) | |
| tree | 6483633834a24f2d0d60bd59a2d808ed76e265ab | |
| parent | 0687dc06c873d4dac0b604d642d724c2f5abb6b6 (diff) | |
tun: freebsd: avoid OOB writes
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
| -rw-r--r-- | tun/tun_freebsd.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/tun/tun_freebsd.go b/tun/tun_freebsd.go index 37f1a0c..c4c6b64 100644 --- a/tun/tun_freebsd.go +++ b/tun/tun_freebsd.go @@ -8,6 +8,7 @@ package tun import ( "errors" "fmt" + "io" "net" "os" "sync" @@ -347,7 +348,13 @@ func (tun *NativeTun) Read(buff []byte, offset int) (int, error) { } func (tun *NativeTun) Write(buf []byte, offset int) (int, error) { + if offset < 4 { + return 0, io.ErrShortBuffer + } buf = buf[offset-4:] + if len(buf) < 5 { + return 0, io.ErrShortBuffer + } buf[0] = 0x00 buf[1] = 0x00 buf[2] = 0x00 |