diff options
| -rw-r--r-- | sys/amd64/amd64/machdep.c | 22 | ||||
| -rw-r--r-- | sys/i386/i386/machdep.c | 22 |
2 files changed, 32 insertions, 12 deletions
diff --git a/sys/amd64/amd64/machdep.c b/sys/amd64/amd64/machdep.c index 1c0d37d..d5c8b9a 100644 --- a/sys/amd64/amd64/machdep.c +++ b/sys/amd64/amd64/machdep.c @@ -533,7 +533,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code) else { /* Old FreeBSD-style arguments. */ sf.sf_arg2 = code; - sf.sf_addr = regs->tf_err; + sf.sf_addr = (register_t *)regs->tf_err; sf.sf_ahu.sf_handler = catcher; } @@ -686,7 +686,7 @@ sendsig(catcher, sig, mask, code) else { /* Old FreeBSD-style arguments. */ sf.sf_siginfo = code; - sf.sf_addr = regs->tf_err; + sf.sf_addr = (register_t *)regs->tf_err; sf.sf_ahu.sf_handler = catcher; } @@ -874,11 +874,21 @@ sigreturn(p, uap) int cs, eflags; ucp = uap->sigcntxp; - if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_READ)) - return(EFAULT); - if (((struct osigcontext *)uap->sigcntxp)->sc_trapno == 0x01d516) - return osigreturn(p, (struct osigreturn_args *)uap); + if (!useracc((caddr_t)ucp, sizeof(struct osigcontext), VM_PROT_READ)) + return (EFAULT); + if (((struct osigcontext *)ucp)->sc_trapno == 0x01d516) + return (osigreturn(p, (struct osigreturn_args *)uap)); + + /* + * Since ucp is not an osigcontext but a ucontext_t, we have to + * check again if all of it is accessible. A ucontext_t is + * much larger, so instead of just checking for the pointer + * being valid for the size of an osigcontext, now check for + * it being valid for a whole, new-style ucontext_t. + */ + if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_READ)) + return (EFAULT); regs = p->p_md.md_regs; eflags = ucp->uc_mcontext.mc_eflags; diff --git a/sys/i386/i386/machdep.c b/sys/i386/i386/machdep.c index 1c0d37d..d5c8b9a 100644 --- a/sys/i386/i386/machdep.c +++ b/sys/i386/i386/machdep.c @@ -533,7 +533,7 @@ osendsig(sig_t catcher, int sig, sigset_t *mask, u_long code) else { /* Old FreeBSD-style arguments. */ sf.sf_arg2 = code; - sf.sf_addr = regs->tf_err; + sf.sf_addr = (register_t *)regs->tf_err; sf.sf_ahu.sf_handler = catcher; } @@ -686,7 +686,7 @@ sendsig(catcher, sig, mask, code) else { /* Old FreeBSD-style arguments. */ sf.sf_siginfo = code; - sf.sf_addr = regs->tf_err; + sf.sf_addr = (register_t *)regs->tf_err; sf.sf_ahu.sf_handler = catcher; } @@ -874,11 +874,21 @@ sigreturn(p, uap) int cs, eflags; ucp = uap->sigcntxp; - if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_READ)) - return(EFAULT); - if (((struct osigcontext *)uap->sigcntxp)->sc_trapno == 0x01d516) - return osigreturn(p, (struct osigreturn_args *)uap); + if (!useracc((caddr_t)ucp, sizeof(struct osigcontext), VM_PROT_READ)) + return (EFAULT); + if (((struct osigcontext *)ucp)->sc_trapno == 0x01d516) + return (osigreturn(p, (struct osigreturn_args *)uap)); + + /* + * Since ucp is not an osigcontext but a ucontext_t, we have to + * check again if all of it is accessible. A ucontext_t is + * much larger, so instead of just checking for the pointer + * being valid for the size of an osigcontext, now check for + * it being valid for a whole, new-style ucontext_t. + */ + if (!useracc((caddr_t)ucp, sizeof(ucontext_t), VM_PROT_READ)) + return (EFAULT); regs = p->p_md.md_regs; eflags = ucp->uc_mcontext.mc_eflags; |
