diff options
author | nectar <nectar@FreeBSD.org> | 2003-10-02 15:00:55 +0000 |
---|---|---|
committer | nectar <nectar@FreeBSD.org> | 2003-10-02 15:00:55 +0000 |
commit | 1857c0891b674258c28f179aeb7ac8084e6332af (patch) | |
tree | 68412e3bf4d1659ce2d53448d555682b65c6edae /sys/kern/kern_subr.c | |
parent | 5dd11b6b7abea284ab69bc7728805be21c1bf67e (diff) | |
download | FreeBSD-src-1857c0891b674258c28f179aeb7ac8084e6332af.zip FreeBSD-src-1857c0891b674258c28f179aeb7ac8084e6332af.tar.gz |
Introduce a uiomove_frombuf helper routine that handles computing and
validating the offset within a given memory buffer before handing the
real work off to uiomove(9).
Use uiomove_frombuf in procfs to correct several issues with
integer arithmetic that could result in underflows/overflows. As a
side-effect, the code is significantly simplified.
Add additional sanity checks when computing a memory allocation size
in pfs_read.
Submitted by: rwatson (original uiomove_frombuf -- bugs are mine :-)
Reported by: Joost Pol <joost@pine.nl> (integer underflows/overflows)
Diffstat (limited to 'sys/kern/kern_subr.c')
-rw-r--r-- | sys/kern/kern_subr.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/sys/kern/kern_subr.c b/sys/kern/kern_subr.c index 769dd1d..2de9d77 100644 --- a/sys/kern/kern_subr.c +++ b/sys/kern/kern_subr.c @@ -47,6 +47,7 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/ktr.h> +#include <sys/limits.h> #include <sys/lock.h> #include <sys/mutex.h> #include <sys/proc.h> @@ -198,6 +199,28 @@ out: return (error); } +/* + * Wrapper for uiomove() that validates the arguments against a known-good + * kernel buffer. Currently, uiomove accepts a signed (n) argument, which + * is almost definitely a bad thing, so we catch that here as well. We + * return a runtime failure, but it might be desirable to generate a runtime + * assertion failure instead. + */ +int +uiomove_frombuf(void *buf, int buflen, struct uio *uio) +{ + unsigned int offset, n; + + if (uio->uio_offset < 0 || uio->uio_resid < 0 || + (offset = uio->uio_offset) != uio->uio_offset) + return (EINVAL); + if (buflen <= 0 || offset >= buflen) + return (0); + if ((n = buflen - offset) > INT_MAX) + return (EINVAL); + return (uiomove((char *)buf + offset, n, uio)); +} + #ifdef ZERO_COPY_SOCKETS /* * Experimental support for zero-copy I/O |