From 9b2dc15ca0fb622177f64aec7470545687d11030 Mon Sep 17 00:00:00 2001
From: Colin Percival <cperciva@FreeBSD.org>
Date: Fri, 6 May 2005 02:40:18 +0000
Subject: [PATCH] Correctly validate inputs to the i386_get_ldt syscall.

Security: FreeBSD-SA-05:07.ldt
---
 sys/i386/i386/sys_machdep.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c
index 22f70248c33b..1f4e90782f27 100644
--- a/sys/i386/i386/sys_machdep.c
+++ b/sys/i386/i386/sys_machdep.c
@@ -476,10 +476,6 @@ i386_get_ldt(td, uap)
 	    uap->start, uap->num, (void *)uap->descs);
 #endif
 
-	/* verify range of LDTs exist */
-	if ((uap->start < 0) || (uap->num <= 0))
-		return(EINVAL);
-
 	if (pldt) {
 		nldt = pldt->ldt_len;
 		num = min(uap->num, nldt);
@@ -489,7 +485,10 @@ i386_get_ldt(td, uap)
 		num = min(uap->num, nldt);
 		lp = &ldt[uap->start];
 	}
-	if (uap->start + num > nldt)
+
+	if ((uap->start > (unsigned int)nldt) ||
+	    ((unsigned int)num > (unsigned int)nldt) ||
+	    ((unsigned int)(uap->start + num) > (unsigned int)nldt))
 		return(EINVAL);
 
 	error = copyout(lp, uap->descs, num * sizeof(union descriptor));