K 10
svn:author
V 7
git2svn
K 8
svn:date
V 27
2021-12-06T14:19:17.652120Z
K 7
svn:log
V 601
dummynet: Avoid an out-of-bounds read in do_config()

do_config() processes a buffer of variable-length dummynet commands.
The loop which processes this buffer loads the fixed-length header
before checking whether there are any bytes left to read, so it performs
a 4-byte read past the end of the buffer before terminating.

Restructure the loop to avoid this.

Reported by:	Jenkins (KASAN job)
Reviewed by:	kp
Sponsored by:	The FreeBSD Foundation

(cherry picked from commit d5ea04ee7ba6c7cd8e0918a080caf5f2c8fb3955)

Git Hash:   55351c2620c5c9387cacc47def0f8c0bcec237f0
Git Author: markj@FreeBSD.org
END