d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make ps_nargvstr and ps_nenvstr unsigned. This fixes an input

Browse Source 
validation error in procfs/linprocfs that can be exploited by local
users to cause a kernel panic.  All versions of FreeBSD with the patch
referenced in SA-04:17.procfs have this bug, but versions without that
patch have a more serious bug instead.  This problem only affects
systems on which procfs or linprocfs is mounted.

Found by:	Coverity Prevent analysis tool
Security:	Local DOS
This commit is contained in:
David Schultz 2005-03-23 08:27:59 +00:00
parent 58ce5a2700
commit f2c7668eb1
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/amd64/linux32/linux32_sysvec.c
View File

@ -207,9 +207,9 @@ static int _bsd_to_linux_trapcode[] = {
struct linux32_ps_strings {
u_int32_t ps_argvstr; /* first of 0 or more argument strings */
int ps_nargvstr; /* the number of argument strings */
u_int ps_nargvstr; /* the number of argument strings */
u_int32_t ps_envstr; /* first of 0 or more environment strings */
int ps_nenvstr; /* the number of environment strings */
u_int ps_nenvstr; /* the number of environment strings */
};
/*

4
sys/sys/exec.h
View File

@ -48,9 +48,9 @@
*/
struct ps_strings {
char **ps_argvstr; /* first of 0 or more argument strings */
int ps_nargvstr; /* the number of argument strings */
unsigned int ps_nargvstr; /* the number of argument strings */
char **ps_envstr; /* first of 0 or more environment strings */
int ps_nenvstr; /* the number of environment strings */
unsigned int ps_nenvstr; /* the number of environment strings */
};
/*