diff options
| author | cperciva <cperciva@FreeBSD.org> | 2009-03-23 00:00:50 +0000 |
|---|---|---|
| committer | cperciva <cperciva@FreeBSD.org> | 2009-03-23 00:00:50 +0000 |
| commit | b7238dced470f241b46f4256b6cb23f37d257885 (patch) | |
| tree | 4cbc1fe81db80b307ba15e4804fb825c4d94e902 /sys/kern/kern_time.c | |
| parent | 106f32b27d5cca98bf5757cbc38a11036042aa71 (diff) | |
| download | FreeBSD-src-b7238dced470f241b46f4256b6cb23f37d257885.zip FreeBSD-src-b7238dced470f241b46f4256b6cb23f37d257885.tar.gz | |
Correctly sanity-check timer IDs. [SA-09:06]
Limit the size of malloced buffer when dumping environment
variables. [EN-09:01]
Approved by: so (cperciva)
Approved by: re (kensmith)
Security: FreeBSD-SA-09:06.ktimer
Errata: FreeBSD-EN-09:01.kenv
Diffstat (limited to 'sys/kern/kern_time.c')
| -rw-r--r-- | sys/kern/kern_time.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c index a8ecace..99c1a53 100644 --- a/sys/kern/kern_time.c +++ b/sys/kern/kern_time.c @@ -1085,7 +1085,8 @@ itimer_find(struct proc *p, int timerid) struct itimer *it; PROC_LOCK_ASSERT(p, MA_OWNED); - if ((p->p_itimers == NULL) || (timerid >= TIMER_MAX) || + if ((p->p_itimers == NULL) || + (timerid < 0) || (timerid >= TIMER_MAX) || (it = p->p_itimers->its_timers[timerid]) == NULL) { return (NULL); } |
