FreeBSD: Upgrade to FreeBSD-releng-13.0 compiled, to be tested.
IPv6: FreeBSD stack and f-stack support ipv6.
Fix tautological comparisonCorresponding upstream changeset: https://github.com/freebsd/freebsd/commit/d45a807e
Fix #114: An out of bounds of memory in netinet/libalias/alias_sctp.c.Run with valgrind, and found this:==2228== Invalid write of size 8==2228== at 0x4E05DA: AliasSctpInit (alias_sctp.c:641)=
Fix #114: An out of bounds of memory in netinet/libalias/alias_sctp.c.Run with valgrind, and found this:==2228== Invalid write of size 8==2228== at 0x4E05DA: AliasSctpInit (alias_sctp.c:641)==2228== by 0x4DE565: LibAliasInit (alias_db.c:2503)==2228== by 0x4E9B3B: nat44_config (ip_fw_nat.c:505)==2228== by 0x4E9E91: nat44_cfg (ip_fw_nat.c:599)==2228== by 0x4F1719: ipfw_ctl3 (ip_fw_sockopt.c:3666)==2228== by 0x4B9954: rip_ctloutput (raw_ip.c:659)==2228== by 0x447E11: sosetopt (uipc_socket.c:2505)==2228== by 0x44BF4D: kern_setsockopt (uipc_syscalls.c:1407)==2228== by 0x409F08: ff_setsockopt (ff_syscall_wrapper.c:412)==2228== by 0x5277AA: handle_ipfw_msg (ff_dpdk_if.c:1146)==2228== by 0x52788C: handle_msg (ff_dpdk_if.c:1196)==2228== by 0x5289B8: process_msg_ring (ff_dpdk_if.c:1213)==2228== Address 0x60779b0 is 4,800 bytes inside a block of size 4,802alloc'd==2228== at 0x4C2ABBD: malloc (vg_replace_malloc.c:296)==2228== by 0x509F15: ff_malloc (ff_host_interface.c:89)==2228== by 0x4053BE: malloc (ff_glue.c:1021)==2228== by 0x4E054E: AliasSctpInit (alias_sctp.c:632)==2228== by 0x4DE565: LibAliasInit (alias_db.c:2503)==2228== by 0x4E9B3B: nat44_config (ip_fw_nat.c:505)==2228== by 0x4E9E91: nat44_cfg (ip_fw_nat.c:599)==2228== by 0x4F1719: ipfw_ctl3 (ip_fw_sockopt.c:3666)==2228== by 0x4B9954: rip_ctloutput (raw_ip.c:659)==2228== by 0x447E11: sosetopt (uipc_socket.c:2505)==2228== by 0x44BF4D: kern_setsockopt (uipc_syscalls.c:1407)==2228== by 0x409F08: ff_setsockopt (ff_syscall_wrapper.c:412)==2228==The error line is:`la->sctpNatTimer.TimerQ = sn_calloc(SN_TIMER_QUEUE_SIZE, sizeof(structsctpTimerQ));`Since SN_TIMER_QUEUE_SIZE is defined as SN_MAX_TIMER+2, and sn_calloc isdefined as sn_malloc(x * n) if _SYS_MALLOC_H_ is defined, the size ofcalloced memory will be wrong, because the macro will be expanded tosizeof(struct sctpTimerQ)*SN_MAX_TIMER+2.And the memory will be out of bounds here.```/* Initialise circular timer Q*/for (i = 0; i < SN_TIMER_QUEUE_SIZE; i++) LIST_INIT(&la->sctpNatTimer.TimerQ[i]);```
show more ...
init