d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid leaking data from the kernel environment: When we convert the

Browse Source 
initial static environment to a dynamic one, zero the static environment
buffer, and zero individual values when kern_unsetenv and freeenv are
called.

Tested by:	kmoore (VM memory dump + grep)
Tested by:	cperciva (kernel panic dump + grep)
This commit is contained in:
Colin Percival 2014-10-22 23:35:32 +00:00
parent 6a30c96cdc
commit b9f6af45a5
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=273487
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/kern/kern_environment.c
View File

@ -224,7 +224,7 @@ init_static_kenv(char *buf, size_t len)
static void
init_dynamic_kenv(void *data __unused)
{
char *cp;
char *cp, *cpnext;
size_t len;
int i;
@ -232,7 +232,8 @@ init_dynamic_kenv(void *data __unused)
M_WAITOK | M_ZERO);
i = 0;
if (kern_envp && *kern_envp != '\0') {
for (cp = kern_envp; cp != NULL; cp = kernenv_next(cp)) {
for (cp = kern_envp; cp != NULL; cp = cpnext) {
cpnext = kernenv_next(cp);
len = strlen(cp) + 1;
if (len > KENV_MNAMELEN + 1 + KENV_MVALLEN + 1) {
printf(
@ -243,6 +244,7 @@ init_dynamic_kenv(void *data __unused)
if (i < KENV_SIZE) {
kenvp[i] = malloc(len, M_KENV, M_WAITOK);
strcpy(kenvp[i++], cp);
memset(cp, 0, strlen(cp));
} else
printf(
"WARNING: too many kenv strings, ignoring %s\n",
@ -260,8 +262,10 @@ void
freeenv(char *env)
{
if (dynamic_kenv)
if (dynamic_kenv) {
memset(env, 0, strlen(env));
free(env, M_KENV);
}
}
/*
@ -437,6 +441,7 @@ kern_unsetenv(const char *name)
kenvp[i++] = kenvp[j];
kenvp[i] = NULL;
mtx_unlock(&kenv_lock);
memset(oldenv, 0, strlen(oldenv));
free(oldenv, M_KENV);
return (0);
}