d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bounds check the user-supplied length used in a copyout() in

Browse Source 
svr4_do_getmsg().  In principle this bug could disclose data from
kernel memory, but in practice, the SVR4 emulation layer is probably
not functional enough to cause the relevant code path to be executed.
In any case, the emulator has been disconnected from the build since
5.0-RELEASE.

Found by:	Coverity Prevent analysis tool
This commit is contained in:
David Schultz 2005-03-23 08:28:06 +00:00
parent 8a4d2b06c7
commit a3e1ec194d
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/compat/svr4/svr4_stream.c
View File

@ -2226,6 +2226,8 @@ svr4_do_getmsg(td, uap, fp)
} }
if (uap->ctl) { if (uap->ctl) {
if (ctl.len > sizeof(sc))
ctl.len = sizeof(sc);
if (ctl.len != -1) if (ctl.len != -1)
if ((error = copyout(&sc, ctl.buf, ctl.len)) != 0) if ((error = copyout(&sc, ctl.buf, ctl.len)) != 0)
return error; return error;