d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make the nsops' variable in semop' unsigned. This prevents an

Browse Source 
overflow if uap->nsops (which is already unsigned) is over INT_MAX;
consequently, the bounds check below becomes valid.  Previously, if a
value over INT_MAX was passed in uap->nsops, the bounds check wouldn't
catch it, and the value would be used to compute copyin()'s third
argument.

Obtained from:	NetBSD
This commit is contained in:
dd 2001-09-10 11:36:08 +00:00
parent bd6f9cb9b6
commit afcc728682
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/kern/sysv_sem.c
View File

@ -781,7 +781,7 @@ semget(p, uap)
struct semop_args { struct semop_args {
int semid; int semid;
struct sembuf *sops; struct sembuf *sops;
int nsops; u_int nsops;
}; };
#endif #endif
@ -794,7 +794,7 @@ semop(p, uap)
register struct semop_args *uap; register struct semop_args *uap;
{ {
int semid = uap->semid; int semid = uap->semid;
int nsops = uap->nsops; u_int nsops = uap->nsops;
struct sembuf sops[MAX_SOPS]; struct sembuf sops[MAX_SOPS];
register struct semid_ds *semaptr; register struct semid_ds *semaptr;
register struct sembuf *sopptr; register struct sembuf *sopptr;
@ -804,7 +804,7 @@ semop(p, uap)
int do_wakeup, do_undos; int do_wakeup, do_undos;
#ifdef SEM_DEBUG #ifdef SEM_DEBUG
printf("call to semop(%d, 0x%x, %d)\n", semid, sops, nsops); printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops);
#endif #endif
mtx_lock(&Giant); mtx_lock(&Giant);
@ -840,7 +840,7 @@ semop(p, uap)
if (nsops > MAX_SOPS) { if (nsops > MAX_SOPS) {
#ifdef SEM_DEBUG #ifdef SEM_DEBUG
printf("too many sops (max=%d, nsops=%d)\n", MAX_SOPS, nsops); printf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops);
#endif #endif
error = E2BIG; error = E2BIG;
goto done2; goto done2;
@ -848,7 +848,7 @@ semop(p, uap)
if ((error = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { if ((error = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) {
#ifdef SEM_DEBUG #ifdef SEM_DEBUG
printf("error = %d from copyin(%08x, %08x, %d)\n", error, printf("error = %d from copyin(%08x, %08x, %u)\n", error,
uap->sops, &sops, nsops * sizeof(sops[0])); uap->sops, &sops, nsops * sizeof(sops[0]));
#endif #endif
goto done2; goto done2;