diff options
author | glebius <glebius@FreeBSD.org> | 2016-03-16 22:35:55 +0000 |
---|---|---|
committer | glebius <glebius@FreeBSD.org> | 2016-03-16 22:35:55 +0000 |
commit | 4c0b9655c91bb58a191d3035dcc3c143fd688b81 (patch) | |
tree | a66ab5c6eaa8e2491dc957e595818c3a3cae91c8 /sys/amd64 | |
parent | 3193ea52fd31d9d871e5e5712303eb71d4713e36 (diff) | |
download | FreeBSD-src-4c0b9655c91bb58a191d3035dcc3c143fd688b81.zip FreeBSD-src-4c0b9655c91bb58a191d3035dcc3c143fd688b81.tar.gz |
Merge r296956:
Due to invalid use of a signed intermediate value in the bounds checking
during argument validity verification, unbound zero'ing of the process LDT
and adjacent memory can be initiated from usermode.
Submitted by: CORE Security
Patch by: kib
Security: SA-16:15
Diffstat (limited to 'sys/amd64')
-rw-r--r-- | sys/amd64/amd64/sys_machdep.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index 98d47b8..ff3bd3e 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -591,8 +591,8 @@ amd64_set_ldt(td, uap, descs) struct i386_ldt_args *uap; struct user_segment_descriptor *descs; { - int error = 0, i; - int largest_ld; + int error = 0; + unsigned int largest_ld, i; struct mdproc *mdp = &td->td_proc->p_md; struct proc_ldt *pldt; struct user_segment_descriptor *dp; |