diff options
| author | glebius <glebius@FreeBSD.org> | 2016-03-16 22:33:12 +0000 |
|---|---|---|
| committer | glebius <glebius@FreeBSD.org> | 2016-03-16 22:33:12 +0000 |
| commit | ecffce941a074abbd944385dc1cc659f4df1b04d (patch) | |
| tree | 1b67ea6ba87ccb549a0fad13efe696fae71b799a /sys/amd64 | |
| parent | 7d1fd13da94eb69908d25dc487cad4b4ea50c4d0 (diff) | |
| download | FreeBSD-src-ecffce941a074abbd944385dc1cc659f4df1b04d.zip FreeBSD-src-ecffce941a074abbd944385dc1cc659f4df1b04d.tar.gz | |
Due to invalid use of a signed intermediate value in the bounds checking
during argument validity verification, unbound zero'ing of the process LDT
and adjacent memory can be initiated from usermode.
Submitted by: CORE Security
Patch by: kib
Security: SA-16:15
Diffstat (limited to 'sys/amd64')
| -rw-r--r-- | sys/amd64/amd64/sys_machdep.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/amd64/amd64/sys_machdep.c b/sys/amd64/amd64/sys_machdep.c index 7d9a748..7f6c50e 100644 --- a/sys/amd64/amd64/sys_machdep.c +++ b/sys/amd64/amd64/sys_machdep.c @@ -580,8 +580,8 @@ amd64_set_ldt(td, uap, descs) struct i386_ldt_args *uap; struct user_segment_descriptor *descs; { - int error = 0, i; - int largest_ld; + int error = 0; + unsigned int largest_ld, i; struct mdproc *mdp = &td->td_proc->p_md; struct proc_ldt *pldt; struct user_segment_descriptor *dp; |
