d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

elf_note_prpsinfo: handle more failures from proc_getargv()

Browse Source 
Resulting sbuf_len() from proc_getargv() might return 0 if user mangled
ps_strings enough. Also, sbuf_len() API contract is to return -1 if the
buffer overflowed. The later should not occur because get_ps_strings()
checks for catenated length, but check for this subtle detail explicitly
as well to be more resilent.

The end result is that p_comm is used in this situations.

Approved by:	so
Security:	FreeBSD-SA-22:09.elf
Reported by:	Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
Reviewed by:	delphij, markj
admbugs:	988
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D35391
This commit is contained in:
Konstantin Belousov 2022-06-03 11:21:23 +03:00 committed by Mark Johnston
parent 6b6367ba8f
commit 00d17cf342
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/compat/linux/linux_elf.c
View File

@ -155,13 +155,16 @@ __linuxN(note_prpsinfo)(void *arg, struct sbuf *sb, size_t *sizep)
sizeof(psinfo->pr_psargs), SBUF_FIXEDLEN);
error = proc_getargv(curthread, p, &sbarg);
PRELE(p);
if (sbuf_finish(&sbarg) == 0)
if (sbuf_finish(&sbarg) == 0) {
len = sbuf_len(&sbarg) - 1;
else
if (len > 0)
len--;
} else {
len = sizeof(psinfo->pr_psargs) - 1;
}
sbuf_delete(&sbarg);
}
if (error || len == 0)
if (error != 0 || len == 0 || (ssize_t)len == -1)
strlcpy(psinfo->pr_psargs, p->p_comm,
sizeof(psinfo->pr_psargs));
else {

11
sys/kern/imgact_elf.c
View File

@ -2205,13 +2205,16 @@ __elfN(note_prpsinfo)(void *arg, struct sbuf *sb, size_t *sizep)
sizeof(psinfo->pr_psargs), SBUF_FIXEDLEN);
error = proc_getargv(curthread, p, &sbarg);
PRELE(p);
if (sbuf_finish(&sbarg) == 0)
len = sbuf_len(&sbarg) - 1;
else
if (sbuf_finish(&sbarg) == 0) {
len = sbuf_len(&sbarg);
if (len > 0)
len--;
} else {
len = sizeof(psinfo->pr_psargs) - 1;
}
sbuf_delete(&sbarg);
}
if (error || len == 0)
if (error != 0 || len == 0 || (ssize_t)len == -1)
strlcpy(psinfo->pr_psargs, p->p_comm,
sizeof(psinfo->pr_psargs));
else {