d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

If the struct mac copied into the kernel has a negative length, return

Browse Source 
EINVAL rather than failing the following malloc due to the value being
too large.
This commit is contained in:
Robert Watson 2003-09-29 18:35:17 +00:00
parent 6cfa0cbdee
commit cc7b13bfe0
9 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/kern/kern_mac.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_framework.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_internal.h
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_net.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_pipe.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_process.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_syscalls.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_system.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);

3
sys/security/mac/mac_vfs.c
View File

@ -1176,7 +1176,8 @@ static int
mac_check_structmac_consistent(struct mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
if (mac->m_buflen < 0 ||
mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
return (EINVAL);
return (0);