diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c index 95cebb495f5b..591ba6d2cb71 100644 --- a/sys/compat/linprocfs/linprocfs.c +++ b/sys/compat/linprocfs/linprocfs.c @@ -769,6 +769,7 @@ static int linprocfs_doproccmdline(PFS_FILL_ARGS) { struct ps_strings pstr; + char **ps_argvstr; int error, i; /* @@ -794,10 +795,21 @@ linprocfs_doproccmdline(PFS_FILL_ARGS) sizeof(pstr)); if (error) return (error); + if (pstr.ps_nargvstr > ARG_MAX) + return (E2BIG); + ps_argvstr = malloc(pstr.ps_nargvstr * sizeof(char *), + M_TEMP, M_WAITOK); + error = copyin((void *)pstr.ps_argvstr, ps_argvstr, + pstr.ps_nargvstr * sizeof(char *)); + if (error) { + free(ps_argvstr, M_TEMP); + return (error); + } for (i = 0; i < pstr.ps_nargvstr; i++) { - sbuf_copyin(sb, pstr.ps_argvstr[i], 0); + sbuf_copyin(sb, ps_argvstr[i], 0); sbuf_printf(sb, "%c", '\0'); } + free(ps_argvstr, M_TEMP); } return (0); diff --git a/sys/fs/procfs/procfs_status.c b/sys/fs/procfs/procfs_status.c index b832f42289e8..29e5d1f15db5 100644 --- a/sys/fs/procfs/procfs_status.c +++ b/sys/fs/procfs/procfs_status.c @@ -173,6 +173,7 @@ int procfs_doproccmdline(PFS_FILL_ARGS) { struct ps_strings pstr; + char **ps_argvstr; int error, i; /* @@ -199,10 +200,21 @@ procfs_doproccmdline(PFS_FILL_ARGS) sizeof(pstr)); if (error) return (error); + if (pstr.ps_nargvstr > ARG_MAX) + return (E2BIG); + ps_argvstr = malloc(pstr.ps_nargvstr * sizeof(char *), + M_TEMP, M_WAITOK); + error = copyin((void *)pstr.ps_argvstr, ps_argvstr, + pstr.ps_nargvstr * sizeof(char *)); + if (error) { + free(ps_argvstr, M_TEMP); + return (error); + } for (i = 0; i < pstr.ps_nargvstr; i++) { - sbuf_copyin(sb, pstr.ps_argvstr[i], 0); + sbuf_copyin(sb, ps_argvstr[i], 0); sbuf_printf(sb, "%c", '\0'); } + free(ps_argvstr, M_TEMP); } return (0);