diff options
| author | marcel <marcel@FreeBSD.org> | 2000-03-09 17:52:01 +0000 |
|---|---|---|
| committer | marcel <marcel@FreeBSD.org> | 2000-03-09 17:52:01 +0000 |
| commit | 8e3795df0fb6cdfc739049fb0fcab846da61d760 (patch) | |
| tree | e776d5897d617c602b832d492fe5ae7f44860282 /sys | |
| parent | 62fa4ac2fe44d7266b5b22153255ac8fc00b6864 (diff) | |
| download | FreeBSD-src-8e3795df0fb6cdfc739049fb0fcab846da61d760.zip FreeBSD-src-8e3795df0fb6cdfc739049fb0fcab846da61d760.tar.gz | |
Fix bug in linux_wait4 and linux_waitpid where garbage in the status
argument could panic the kernel.
Submitted by: Ian Dowse <iedowse@maths.tcd.ie>
Prompted by: jkh, gallatin
Approved by: prompters
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/compat/linux/linux_misc.c | 2 | ||||
| -rw-r--r-- | sys/i386/linux/linux_misc.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 1835c9c..1b2dd31 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -988,6 +988,7 @@ linux_waitpid(struct proc *p, struct linux_waitpid_args *args) if (args->status) { if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0) return error; + tmpstat &= 0xffff; if (WIFSIGNALED(tmpstat)) tmpstat = (tmpstat & 0xffffff80) | BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat)); @@ -1031,6 +1032,7 @@ linux_wait4(struct proc *p, struct linux_wait4_args *args) if (args->status) { if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0) return error; + tmpstat &= 0xffff; if (WIFSIGNALED(tmpstat)) tmpstat = (tmpstat & 0xffffff80) | BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat)); diff --git a/sys/i386/linux/linux_misc.c b/sys/i386/linux/linux_misc.c index 1835c9c..1b2dd31 100644 --- a/sys/i386/linux/linux_misc.c +++ b/sys/i386/linux/linux_misc.c @@ -988,6 +988,7 @@ linux_waitpid(struct proc *p, struct linux_waitpid_args *args) if (args->status) { if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0) return error; + tmpstat &= 0xffff; if (WIFSIGNALED(tmpstat)) tmpstat = (tmpstat & 0xffffff80) | BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat)); @@ -1031,6 +1032,7 @@ linux_wait4(struct proc *p, struct linux_wait4_args *args) if (args->status) { if ((error = copyin(args->status, &tmpstat, sizeof(int))) != 0) return error; + tmpstat &= 0xffff; if (WIFSIGNALED(tmpstat)) tmpstat = (tmpstat & 0xffffff80) | BSD_TO_LINUX_SIGNAL(WTERMSIG(tmpstat)); |
