d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
51bcc337dd
freebsd-dev/sys
History
Conrad Meyer 51bcc337dd netsmb: Fix buggy/racy smb_strdupin() 
smb_strdupin() tried to roll a copyin() based strlen to allocate a buffer
and then blindly copyin that size.  Of course, a malicious user program
could simultaneously manipulate the buffer, resulting in a non-terminated
string being copied.

Later assumptions in the code rely upon the string being nul-terminated.

Just use copyinstr() and drop the racy sizing.

PR:		222687
Reported by:	Meng Xu <meng.xu AT gatech.edu>
Security:	possible local DoS
Sponsored by:	Dell EMC Isilon
2017-09-29 15:53:26 +00:00
..
amd64 Do not do torn writes to active LDTs. 2017-09-19 17:57:04 +00:00
arm a10_gpio: Enable all needed clocks 2017-09-26 20:23:09 +00:00
arm64 Fix indentation for r323068 2017-09-19 20:40:05 +00:00
boot Compile loader as Little-Endian on PPC64/POWER8 2017-09-29 06:36:19 +00:00
bsm
cam cam iosched: Bettar account IOPS for smoother performance 2017-09-22 02:36:36 +00:00
cddl Use C99 initializers for DTrace provider methods. 2017-09-27 17:46:38 +00:00
compat Small style(9) issue: spaces vs TAB. 2017-09-24 20:57:03 +00:00
conf aesni(4): Add support for x86 SHA intrinsics 2017-09-26 23:12:32 +00:00
contrib Modernize the use of vm_page_unwire(). Since r288122, vm_page_unwire() 2017-09-24 22:29:11 +00:00
crypto aesni(4): Add support for x86 SHA intrinsics 2017-09-26 23:12:32 +00:00
ddb Rename mkdumpheader() and group EKCD functions in kern_shutdown.c. 2017-08-18 04:04:09 +00:00
dev Convert sysctl sbuf usage to use a fully dynaic sbuf. This is strictly 2017-09-29 04:52:15 +00:00
fs Add the NFS client state flag that enables Flexible File Layout. 2017-09-28 23:05:08 +00:00
gdb
geom g_resize_provider_event: Do not invoke orphan method twice 2017-09-24 19:59:26 +00:00
gnu
i386 A different fix for the issue from r323722. 2017-09-28 09:01:28 +00:00
isa Use better hard-coded defaults for the cursor shape, and remove nearby 2017-08-19 19:33:16 +00:00
kern Revert r323722. A better fix will be committed shortly, as well as 2017-09-28 08:38:24 +00:00
kgssapi
libkern Continuing efforts to provide hardening of FFS, this change adds a 2017-09-22 12:45:15 +00:00
mips bhnd: Add support for supplying bus I/O callbacks when initializing an EROM 2017-09-27 19:48:34 +00:00
modules bhnd: Add support for supplying bus I/O callbacks when initializing an EROM 2017-09-27 19:48:34 +00:00
net Add PNP metadata to more drivers 2017-09-26 23:23:58 +00:00
net80211 net80211: fix a typo (premable -> preamble). 2017-08-27 22:13:03 +00:00
netgraph Correction after r323873: #include <sys/lock.h> in addition to <sys/rmlock.h> 2017-09-28 11:26:37 +00:00
netinet Some mbuf related fixes in icmp_error() 2017-09-29 06:24:45 +00:00
netinet6 Fix a locking issue found by Coverity scanning the usrsctp library. 2017-09-09 20:51:54 +00:00
netipsec opencrypto: Loosen restriction on HMAC key sizes 2017-09-26 16:18:10 +00:00
netpfil Use in_localip() function instead of unlocked access to addresses hash 2017-09-20 22:35:28 +00:00
netsmb netsmb: Fix buggy/racy smb_strdupin() 2017-09-29 15:53:26 +00:00
nfs Improve FHA locality control for NFS read/write requests. 2017-07-31 15:23:19 +00:00
nfsclient
nfsserver
nlm
ofed Remove unsafe access to the LinuxKPI file structure from ibcore. 2017-09-09 06:34:20 +00:00
opencrypto opencrypto: Use C99 initializers for auth_hash instances 2017-09-26 17:52:52 +00:00
powerpc Fix indentation for r323068 2017-09-19 20:40:05 +00:00
riscv Sync with amd64/arm/arm64/i386/mips pmap change r288256: 2017-09-20 04:19:49 +00:00
rpc
security Sprinkle __read_frequently on few obvious places. 2017-09-06 20:33:33 +00:00
sparc64 Fix indentation for r323068 2017-09-19 20:40:05 +00:00
sys Improve description of the PNP string a bit. 2017-09-27 19:21:52 +00:00
teken Fix syscons escape sequence for setting the local cursor type. This sequence 2017-08-18 15:40:40 +00:00
tests
tools
ufs Don't defer wakeup()s for completed journal workitems. 2017-09-26 23:24:15 +00:00
vm Optimize vm_object_page_remove() by eliminating pointless calls to 2017-09-28 17:55:41 +00:00
x86 x86: Decode AMD "Extended Feature Extensions ID EBX" bits 2017-09-20 18:30:37 +00:00
xdr
xen
Makefile