From 2705fe5cc132ba44ee6bdb210ae3bff5be670722 Mon Sep 17 00:00:00 2001 From: jhb Date: Thu, 22 Oct 2015 21:23:58 +0000 Subject: Merge r289055 to amd64/linux32: linux: fix handling of out-of-bounds syscall attempts Due to an off by one the code would read an entry past the table, as opposed to the last entry which contains the nosys handler. --- sys/amd64/linux32/linux32_sysvec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sys/amd64/linux32') diff --git a/sys/amd64/linux32/linux32_sysvec.c b/sys/amd64/linux32/linux32_sysvec.c index 4364438..250e16b 100644 --- a/sys/amd64/linux32/linux32_sysvec.c +++ b/sys/amd64/linux32/linux32_sysvec.c @@ -741,7 +741,7 @@ linux32_fetch_syscall_args(struct thread *td, struct syscall_args *sa) if (sa->code >= p->p_sysent->sv_size) /* nosys */ - sa->callp = &p->p_sysent->sv_table[LINUX_SYS_MAXSYSCALL]; + sa->callp = &p->p_sysent->sv_table[p->p_sysent->sv_size - 1]; else sa->callp = &p->p_sysent->sv_table[sa->code]; sa->narg = sa->callp->sy_narg; -- cgit v1.1