diff options
author | cperciva <cperciva@FreeBSD.org> | 2004-12-01 21:33:02 +0000 |
---|---|---|
committer | cperciva <cperciva@FreeBSD.org> | 2004-12-01 21:33:02 +0000 |
commit | ebbf4e4bde2322b38bffad4a30b6d9e09942fc21 (patch) | |
tree | 7cc926ca081a1eae95527fc48d708c1df97d999c | |
parent | 931ffd7d22e27213113c91848a0420789d44af2b (diff) | |
download | FreeBSD-src-ebbf4e4bde2322b38bffad4a30b6d9e09942fc21.zip FreeBSD-src-ebbf4e4bde2322b38bffad4a30b6d9e09942fc21.tar.gz |
Fix unvalidated pointer dereference. This is FreeBSD-SA-04:17.procfs.
-rw-r--r-- | sys/compat/linprocfs/linprocfs.c | 14 | ||||
-rw-r--r-- | sys/fs/procfs/procfs_status.c | 14 |
2 files changed, 26 insertions, 2 deletions
diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c index 95cebb4..591ba6d 100644 --- a/sys/compat/linprocfs/linprocfs.c +++ b/sys/compat/linprocfs/linprocfs.c @@ -769,6 +769,7 @@ static int linprocfs_doproccmdline(PFS_FILL_ARGS) { struct ps_strings pstr; + char **ps_argvstr; int error, i; /* @@ -794,10 +795,21 @@ linprocfs_doproccmdline(PFS_FILL_ARGS) sizeof(pstr)); if (error) return (error); + if (pstr.ps_nargvstr > ARG_MAX) + return (E2BIG); + ps_argvstr = malloc(pstr.ps_nargvstr * sizeof(char *), + M_TEMP, M_WAITOK); + error = copyin((void *)pstr.ps_argvstr, ps_argvstr, + pstr.ps_nargvstr * sizeof(char *)); + if (error) { + free(ps_argvstr, M_TEMP); + return (error); + } for (i = 0; i < pstr.ps_nargvstr; i++) { - sbuf_copyin(sb, pstr.ps_argvstr[i], 0); + sbuf_copyin(sb, ps_argvstr[i], 0); sbuf_printf(sb, "%c", '\0'); } + free(ps_argvstr, M_TEMP); } return (0); diff --git a/sys/fs/procfs/procfs_status.c b/sys/fs/procfs/procfs_status.c index b832f42..29e5d1f 100644 --- a/sys/fs/procfs/procfs_status.c +++ b/sys/fs/procfs/procfs_status.c @@ -173,6 +173,7 @@ int procfs_doproccmdline(PFS_FILL_ARGS) { struct ps_strings pstr; + char **ps_argvstr; int error, i; /* @@ -199,10 +200,21 @@ procfs_doproccmdline(PFS_FILL_ARGS) sizeof(pstr)); if (error) return (error); + if (pstr.ps_nargvstr > ARG_MAX) + return (E2BIG); + ps_argvstr = malloc(pstr.ps_nargvstr * sizeof(char *), + M_TEMP, M_WAITOK); + error = copyin((void *)pstr.ps_argvstr, ps_argvstr, + pstr.ps_nargvstr * sizeof(char *)); + if (error) { + free(ps_argvstr, M_TEMP); + return (error); + } for (i = 0; i < pstr.ps_nargvstr; i++) { - sbuf_copyin(sb, pstr.ps_argvstr[i], 0); + sbuf_copyin(sb, ps_argvstr[i], 0); sbuf_printf(sb, "%c", '\0'); } + free(ps_argvstr, M_TEMP); } return (0); |