Fix a multitude of security bugs in the iBCS2 emulator:

- Return NULL instead of returning memory outside of the stackgap
  in stackgap_alloc() (FreeBSD-SA-00:42.linux)
- Check for stackgap_alloc() returning NULL in ibcs2_emul_find();
  other calls to stackgap_alloc() have not been changed since they
  are small fixed-size allocations.
- Replace use of strcpy() with strlcpy() in exec_coff_imgact()
  to avoid buffer overflow
- Use strlcat() instead of strcat() to avoid a one byte buffer
  overflow in ibcs2_setipdomainname()
- Use copyinstr() instead of copyin() in ibcs2_setipdomainname()
  to ensure that the string is null-terminated
- Avoid integer overflow in ibcs2_setgroups() and ibcs2_setgroups()
  by checking that gidsetsize argument is non-negative and
  no larger than NGROUPS_MAX.
- Range-check signal numbers in ibcs2_wait(), ibcs2_sigaction(),
  ibcs2_sigsys() and ibcs2_kill() to avoid accessing array past
  the end (or before the start)

1 files changed, 5 insertions, 3 deletions

diff --git a/sys/i386/ibcs2/ibcs2_socksys.c b/sys/i386/ibcs2/ibcs2_socksys.c
index 231b37f..21d29b0 100644
--- a/sys/i386/ibcs2/ibcs2_socksys.c
+++ b/sys/i386/ibcs2/ibcs2_socksys.c
@@ -187,8 +187,10 @@ ibcs2_setipdomainname(td, uap)
 	if ( ptr != NULL ) {
 		ptr++;
 		*ptr = '\0';
-	} else
-		strcat(hname, ".");
+	} else {
+		if (strlcat(hname, ".", sizeof(hname)) >= sizeof(hname))
+			return (EINVAL);
+	}
 
 	/* Set ptr to the end of the string so we can append to it */
 	hlen = strlen(hname);
@@ -197,7 +199,7 @@ ibcs2_setipdomainname(td, uap)
                 return EINVAL;
 
 	/* Append the ipdomain to the end */
-	error = copyin((caddr_t)uap->ipdomainname, ptr, uap->len);
+	error = copyinstr((caddr_t)uap->ipdomainname, ptr, uap->len, NULL);
 	if (error)
 		return (error);