add mac multicast address check to profile_check_line

issue #3784
related commit 4bc92b8fd0a5c22c7d4c6f9323378501c60ff149

1 files changed, 6 insertions, 0 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index ff8b47102..4172c96f7 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -745,6 +745,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                                 fprintf(stderr, "Error: invalid MAC address\n");
                                 exit(1);
                         }
+
+                        // check multicast address
+                        if (br->macsandbox[0] & 1) {
+                                fprintf(stderr, "Error: invalid MAC address (multicast)\n");
+                                exit(1);
+                        }
                 }
                 else
                         warning_feature_disabled("networking");