diff options
| author | glebius <glebius@FreeBSD.org> | 2016-03-16 22:46:57 +0000 |
|---|---|---|
| committer | glebius <glebius@FreeBSD.org> | 2016-03-16 22:46:57 +0000 |
| commit | aa2f37618347c98d5117360b00acbe8f1bf33497 (patch) | |
| tree | 743cd335981afe356063b31da0abd12f580845c4 | |
| parent | 51a07c3c28466fdf362fd2c34d21b912bf200c1a (diff) | |
| download | FreeBSD-src-aa2f37618347c98d5117360b00acbe8f1bf33497.zip FreeBSD-src-aa2f37618347c98d5117360b00acbe8f1bf33497.tar.gz | |
Merge r296956:
Due to invalid use of a signed intermediate value in the bounds checking
during argument validity verification, unbound zero'ing of the process LDT
and adjacent memory can be initiated from usermode.
Submitted by: CORE Security
Patch by: kib
Security: SA-16:15
Approved by: re (implicit)
| -rw-r--r-- | sys/amd64/amd64/sys_machdep.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index 98d47b8..ff3bd3e 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -591,8 +591,8 @@ amd64_set_ldt(td, uap, descs) struct i386_ldt_args *uap; struct user_segment_descriptor *descs; { - int error = 0, i; - int largest_ld; + int error = 0; + unsigned int largest_ld, i; struct mdproc *mdp = &td->td_proc->p_md; struct proc_ldt *pldt; struct user_segment_descriptor *dp; |
