diff options
author | tjr <tjr@FreeBSD.org> | 2003-10-20 10:38:48 +0000 |
---|---|---|
committer | tjr <tjr@FreeBSD.org> | 2003-10-20 10:38:48 +0000 |
commit | f2b3ceb410d51e658a31ff42364fdb5ba4807050 (patch) | |
tree | d4a477c513a3c9cad3f7adde8a226d844b78f56e /sys/compat/svr4/svr4_util.h | |
parent | 44cdfe0ed80ea7f0bf415c4ab952824c8e9d873f (diff) | |
download | FreeBSD-src-f2b3ceb410d51e658a31ff42364fdb5ba4807050.zip FreeBSD-src-f2b3ceb410d51e658a31ff42364fdb5ba4807050.tar.gz |
Fix some security bugs in the SVR4 emulator:
- Return NULL instead of returning memory outside of the stackgap
in stackgap_alloc() (FreeBSD-SA-00:42.linux)
- Check for stackgap_alloc() returning NULL in svr4_emul_find(),
and clean_pipe().
- Avoid integer overflow on large nfds argument in svr4_sys_poll()
- Reject negative nbytes argument in svr4_sys_getdents()
- Don't copy out past the end of the struct componentname
pathname buffer in svr4_sys_resolvepath()
- Reject out-of-range signal numbers in svr4_sys_sigaction(),
svr4_sys_signal(), and svr4_sys_kill().
- Don't malloc() user-specified lengths in show_ioc() and
show_strbuf(), place arbitrary limits instead.
- Range-check lengths in si_listen(), ti_getinfo(), ti_bind(),
svr4_do_putmsg(), svr4_do_getmsg(), svr4_stream_ti_ioctl().
Some fixes obtain from OpenBSD.
Diffstat (limited to 'sys/compat/svr4/svr4_util.h')
-rw-r--r-- | sys/compat/svr4/svr4_util.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/compat/svr4/svr4_util.h b/sys/compat/svr4/svr4_util.h index 9e5be7f..e0cb54f 100644 --- a/sys/compat/svr4/svr4_util.h +++ b/sys/compat/svr4/svr4_util.h @@ -63,7 +63,10 @@ stackgap_alloc(sgp, sz) size_t sz; { void *p = (void *) *sgp; - *sgp += ALIGN(sz); + sz = ALIGN(sz); + if (*sgp + sz > (caddr_t)(PS_STRINGS - szsigcode)) + return NULL; + *sgp += sz; return p; } |