d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correctly sanity-check timer IDs. [SA-09:06]

Browse Source 
Limit the size of malloced buffer when dumping environment
variables. [EN-09:01]

Approved by:	so (cperciva)
Approved by:	re (kensmith)
Security:	FreeBSD-SA-09:06.ktimer
Errata:		FreeBSD-EN-09:01.kenv
This commit is contained in:
Colin Percival 2009-03-23 00:00:50 +00:00
parent acd5c42915
commit 3f935cf342
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=190301
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/kern/kern_environment.c
View File

@ -87,7 +87,7 @@ kenv(td, uap)
} */ *uap;
{
char *name, *value, *buffer = NULL;
size_t len, done, needed;
size_t len, done, needed, buflen;
int error, i;
KASSERT(dynamic_kenv, ("kenv: dynamic_kenv = 0"));
@ -100,13 +100,17 @@ kenv(td, uap)
return (error);
#endif
done = needed = 0;
buflen = uap->len;
if (buflen > KENV_SIZE * (KENV_MNAMELEN + KENV_MVALLEN + 2))
buflen = KENV_SIZE * (KENV_MNAMELEN +
KENV_MVALLEN + 2);
if (uap->len > 0 && uap->value != NULL)
buffer = malloc(uap->len, M_TEMP, M_WAITOK|M_ZERO);
buffer = malloc(buflen, M_TEMP, M_WAITOK|M_ZERO);
mtx_lock(&kenv_lock);
for (i = 0; kenvp[i] != NULL; i++) {
len = strlen(kenvp[i]) + 1;
needed += len;
len = min(len, uap->len - done);
len = min(len, buflen - done);
/*
* If called with a NULL or insufficiently large
* buffer, just keep computing the required size.

3
sys/kern/kern_time.c
View File

@ -1085,7 +1085,8 @@ itimer_find(struct proc *p, int timerid)
struct itimer *it;
PROC_LOCK_ASSERT(p, MA_OWNED);
if ((p->p_itimers == NULL) || (timerid >= TIMER_MAX) ||
if ((p->p_itimers == NULL) ||
(timerid < 0) || (timerid >= TIMER_MAX) ||
(it = p->p_itimers->its_timers[timerid]) == NULL) {
return (NULL);
}