Correctly sanity-check timer IDs. [SA-09:06]
Limit the size of malloced buffer when dumping environment variables. [EN-09:01] Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-09:06.ktimer Errata: FreeBSD-EN-09:01.kenv
This commit is contained in:
parent
acd5c42915
commit
3f935cf342
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=190301
@ -87,7 +87,7 @@ kenv(td, uap)
|
||||
} */ *uap;
|
||||
{
|
||||
char *name, *value, *buffer = NULL;
|
||||
size_t len, done, needed;
|
||||
size_t len, done, needed, buflen;
|
||||
int error, i;
|
||||
|
||||
KASSERT(dynamic_kenv, ("kenv: dynamic_kenv = 0"));
|
||||
@ -100,13 +100,17 @@ kenv(td, uap)
|
||||
return (error);
|
||||
#endif
|
||||
done = needed = 0;
|
||||
buflen = uap->len;
|
||||
if (buflen > KENV_SIZE * (KENV_MNAMELEN + KENV_MVALLEN + 2))
|
||||
buflen = KENV_SIZE * (KENV_MNAMELEN +
|
||||
KENV_MVALLEN + 2);
|
||||
if (uap->len > 0 && uap->value != NULL)
|
||||
buffer = malloc(uap->len, M_TEMP, M_WAITOK|M_ZERO);
|
||||
buffer = malloc(buflen, M_TEMP, M_WAITOK|M_ZERO);
|
||||
mtx_lock(&kenv_lock);
|
||||
for (i = 0; kenvp[i] != NULL; i++) {
|
||||
len = strlen(kenvp[i]) + 1;
|
||||
needed += len;
|
||||
len = min(len, uap->len - done);
|
||||
len = min(len, buflen - done);
|
||||
/*
|
||||
* If called with a NULL or insufficiently large
|
||||
* buffer, just keep computing the required size.
|
||||
|
@ -1085,7 +1085,8 @@ itimer_find(struct proc *p, int timerid)
|
||||
struct itimer *it;
|
||||
|
||||
PROC_LOCK_ASSERT(p, MA_OWNED);
|
||||
if ((p->p_itimers == NULL) || (timerid >= TIMER_MAX) ||
|
||||
if ((p->p_itimers == NULL) ||
|
||||
(timerid < 0) || (timerid >= TIMER_MAX) ||
|
||||
(it = p->p_itimers->its_timers[timerid]) == NULL) {
|
||||
return (NULL);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user