 @@ -1,14 +1,14 @@
-/*	$NetBSD: npf_ctl.c,v 1.29 2013/09/19 01:49:07 rmind Exp $	*/
+/*	$NetBSD: npf_ctl.c,v 1.30 2013/10/27 16:22:08 rmind Exp $	*/
 /*-
  * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This material is based upon work partially supported by The
  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -27,27 +27,27 @@
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 /*
  * NPF device control.
+ *
  * Implementation of (re)loading, construction of tables and rules.
  * NPF proplib(9) dictionary consumer.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.29 2013/09/19 01:49:07 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.30 2013/10/27 16:22:08 rmind Exp $");
 #include <sys/param.h>
 #include <sys/conf.h>
 #include <sys/kmem.h>
 #include <net/bpf.h>
 #include <prop/proplib.h>
 #include "npf_impl.h"
 #if defined(DEBUG) || defined(DIAGNOSTIC)
 #define	NPF_ERR_DEBUG(e) \
 	prop_dictionary_set_cstring_nocopy((e), "source-file", __FILE__); \
 @@ -457,53 +457,57 @@ npfctl_reload(u_long cmd, void *data)
 		error = EPROGMISMATCH;
 		goto fail;
+	}
 	/* ALGs. */
 	alglist = prop_dictionary_get(npf_dict, "algs");
 	error = npf_mk_algs(alglist, errdict);
 	if (error) {
 		goto fail;
+	}
 	/* NAT policies. */
 	natlist = prop_dictionary_get(npf_dict, "translation");
-	nitems = prop_array_count(natlist);
+	if ((nitems = prop_array_count(natlist)) > NPF_MAX_RULES) {
 		goto fail;
+	}
 	nset = npf_ruleset_create(nitems);
 	error = npf_mk_natlist(nset, natlist, errdict);
 	if (error) {
 		goto fail;
+	}
 	/* Tables. */
 	tblset = npf_tableset_create();
 	tables = prop_dictionary_get(npf_dict, "tables");
 	error = npf_mk_tables(tblset, tables, errdict);
 	if (error) {
 		goto fail;
+	}
 	/* Rule procedures. */
 	rpset = npf_rprocset_create();
 	rprocs = prop_dictionary_get(npf_dict, "rprocs");
 	error = npf_mk_rprocs(rpset, rprocs, errdict);
 	if (error) {
 		goto fail;
+	}
 	/* Rules. */
 	rules = prop_dictionary_get(npf_dict, "rules");
-	nitems = prop_array_count(rules);
+	if ((nitems = prop_array_count(rules)) > NPF_MAX_RULES) {
 		goto fail;
+	}
 	rlset = npf_ruleset_create(nitems);
 	error = npf_mk_rules(rlset, rules, rpset, errdict);
 	if (error) {
 		goto fail;
+	}
 	flush = false;
 	prop_dictionary_get_bool(npf_dict, "flush", &flush);
 	/*
 	 * Finally - perform the reload.
 	 */

 @@ -1,14 +1,14 @@
-/*	$NetBSD: npf_impl.h,v 1.33 2013/09/19 01:49:07 rmind Exp $	*/
+/*	$NetBSD: npf_impl.h,v 1.34 2013/10/27 16:22:08 rmind Exp $	*/
 /*-
  * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This material is based upon work partially supported by The
  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -90,27 +90,29 @@ struct npf_table;
 typedef struct npf_sehash	npf_sehash_t;
 typedef struct npf_table	npf_table_t;
 typedef npf_table_t *		npf_tableset_t;
 /*
  * DEFINITIONS.
  */
 typedef bool (*npf_alg_func_t)(npf_cache_t *, nbuf_t *, npf_nat_t *, int);
 typedef npf_session_t *(*npf_alg_sfunc_t)(npf_cache_t *, nbuf_t *, int);
 typedef void (*npf_workfunc_t)(void);
 /* Some artificial limits. */
 #define	NPF_TABLE_SLOTS		32
 #define	NPF_MAX_RULES		(1024 * 1024)
 /*
  * SESSION STATE STRUCTURES
  */
 #define	NPF_FLOW_FORW		0
 #define	NPF_FLOW_BACK		1
 typedef struct {
 	uint32_t	nst_end;
 	uint32_t	nst_maxend;
 	uint32_t	nst_maxwin;
 	int		nst_wscale;