d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nandsim: correct test to avoid out-of-bounds access

Browse Source 
Previously nandsim_chip_status returned EINVAL iff both of user-provided
chip->ctrl_num and chip->num were out of bounds.  If only one failed the
bounds check arbitrary memory would be read and returned.

The NAND framework is not built by default, nandsim is not intended for
production use (it is a simulator), and the nandsim device has root-only
permissions.

admbugs:	827
Reported by:	Daniel Hodson of elttam
MFC after:	3 days
Security:	kernel information leak or DoS
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Ed Maste 2019-06-21 13:42:40 +00:00
parent 978f2d1728
commit b72236b407
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=349268
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/dev/nand/nandsim.c
View File

@ -295,7 +295,7 @@ nandsim_chip_status(struct sim_chip *chip)
nand_debug(NDBG_SIM,"status for chip num:%d at ctrl:%d", chip->num,
chip->ctrl_num);
if (chip->ctrl_num >= MAX_SIM_DEV &&
if (chip->ctrl_num >= MAX_SIM_DEV ||
chip->num >= MAX_CTRL_CS)
return (EINVAL);