Correctly sanity-check timer IDs. [SA-09:06]
Limit the size of malloced buffer when dumping environment variables. [EN-09:01] Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-09:06.ktimer Errata: FreeBSD-EN-09:01.kenv
This commit is contained in:
parent
acd5c42915
commit
3f935cf342
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=190301
@ -87,7 +87,7 @@ kenv(td, uap)
|
|||||||
} */ *uap;
|
} */ *uap;
|
||||||
{
|
{
|
||||||
char *name, *value, *buffer = NULL;
|
char *name, *value, *buffer = NULL;
|
||||||
size_t len, done, needed;
|
size_t len, done, needed, buflen;
|
||||||
int error, i;
|
int error, i;
|
||||||
|
|
||||||
KASSERT(dynamic_kenv, ("kenv: dynamic_kenv = 0"));
|
KASSERT(dynamic_kenv, ("kenv: dynamic_kenv = 0"));
|
||||||
@ -100,13 +100,17 @@ kenv(td, uap)
|
|||||||
return (error);
|
return (error);
|
||||||
#endif
|
#endif
|
||||||
done = needed = 0;
|
done = needed = 0;
|
||||||
|
buflen = uap->len;
|
||||||
|
if (buflen > KENV_SIZE * (KENV_MNAMELEN + KENV_MVALLEN + 2))
|
||||||
|
buflen = KENV_SIZE * (KENV_MNAMELEN +
|
||||||
|
KENV_MVALLEN + 2);
|
||||||
if (uap->len > 0 && uap->value != NULL)
|
if (uap->len > 0 && uap->value != NULL)
|
||||||
buffer = malloc(uap->len, M_TEMP, M_WAITOK|M_ZERO);
|
buffer = malloc(buflen, M_TEMP, M_WAITOK|M_ZERO);
|
||||||
mtx_lock(&kenv_lock);
|
mtx_lock(&kenv_lock);
|
||||||
for (i = 0; kenvp[i] != NULL; i++) {
|
for (i = 0; kenvp[i] != NULL; i++) {
|
||||||
len = strlen(kenvp[i]) + 1;
|
len = strlen(kenvp[i]) + 1;
|
||||||
needed += len;
|
needed += len;
|
||||||
len = min(len, uap->len - done);
|
len = min(len, buflen - done);
|
||||||
/*
|
/*
|
||||||
* If called with a NULL or insufficiently large
|
* If called with a NULL or insufficiently large
|
||||||
* buffer, just keep computing the required size.
|
* buffer, just keep computing the required size.
|
||||||
|
@ -1085,7 +1085,8 @@ itimer_find(struct proc *p, int timerid)
|
|||||||
struct itimer *it;
|
struct itimer *it;
|
||||||
|
|
||||||
PROC_LOCK_ASSERT(p, MA_OWNED);
|
PROC_LOCK_ASSERT(p, MA_OWNED);
|
||||||
if ((p->p_itimers == NULL) || (timerid >= TIMER_MAX) ||
|
if ((p->p_itimers == NULL) ||
|
||||||
|
(timerid < 0) || (timerid >= TIMER_MAX) ||
|
||||||
(it = p->p_itimers->its_timers[timerid]) == NULL) {
|
(it = p->p_itimers->its_timers[timerid]) == NULL) {
|
||||||
return (NULL);
|
return (NULL);
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user