d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix some signed/unsigned integer confusion, and add bounds checking of

Browse Source 
arguments to some functions.

Obtained from:	NetBSD
Reviewed by:	peter
MFC after:	2 weeks
This commit is contained in:
kris 2001-09-10 11:28:07 +00:00
parent 335f7eeb63
commit bd6f9cb9b6
16 changed files with 57 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/dev/ccd/ccd.c
View File

@ -1263,6 +1263,9 @@ ccdioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
if ((error = ccdlock(cs)) != 0)
return (error);
if (ccio->ccio_ndisks > CCD_MAXNDISKS)
return (EINVAL);
/* Fill in some important bits. */
cs->sc_ileave = ccio->ccio_ileave;
if (cs->sc_ileave == 0 &&

2
sys/dev/mlx/mlx.c
View File

@ -1876,6 +1876,8 @@ mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu)
/* if we need a buffer for data transfer, allocate one and copy in its initial contents */
if (mu->mu_datasize > 0) {
if (mu->mu_datasize > MAXPHYS)
return (EINVAL);
if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) ||
(error = copyin(mu->mu_buf, kbuf, mu->mu_datasize)))
goto out;

6
sys/fs/umapfs/umap_vfsops.c
View File

@ -167,6 +167,12 @@ umapfs_mount(mp, path, data, ndp, p)
/*
* Now copy in the number of entries and maps for umap mapping.
*/
if (args.nentries > MAPFILEENTRIES || args.gnentries >
GMAPFILEENTRIES) {
vput(lowerrootvp);
return (error);
}
amp->info_nentries = args.nentries;
amp->info_gnentries = args.gnentries;
error = copyin(args.mapdata, (caddr_t)amp->info_mapdata,

3
sys/geom/geom_ccd.c
View File

@ -1263,6 +1263,9 @@ ccdioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
if ((error = ccdlock(cs)) != 0)
return (error);
if (ccio->ccio_ndisks > CCD_MAXNDISKS)
return (EINVAL);
/* Fill in some important bits. */
cs->sc_ileave = ccio->ccio_ileave;
if (cs->sc_ileave == 0 &&

1
sys/i386/include/i4b_ioctl.h
View File

@ -700,6 +700,7 @@ struct isdn_diagnostic_request {
int controller; /* controller number */
u_int32_t cmd; /* diagnostic command to execute */
size_t in_param_len; /* length of additional input parameter */
#define I4B_ACTIVE_DIAGNOSTIC_MAXPARAMLEN 65536
void *in_param; /* optional input parameter */
size_t out_param_len; /* available output space */
void *out_param; /* output data goes here */

1
sys/i4b/include/i4b_ioctl.h
View File

@ -700,6 +700,7 @@ struct isdn_diagnostic_request {
int controller; /* controller number */
u_int32_t cmd; /* diagnostic command to execute */
size_t in_param_len; /* length of additional input parameter */
#define I4B_ACTIVE_DIAGNOSTIC_MAXPARAMLEN 65536
void *in_param; /* optional input parameter */
size_t out_param_len; /* available output space */
void *out_param; /* output data goes here */

7
sys/i4b/layer4/i4b_i4bdrv.c
View File

@ -859,6 +859,13 @@ download_done:
if(req.in_param_len)
{
/* XXX arbitrary limit */
if (req.in_param_len >
I4B_ACTIVE_DIAGNOSTIC_MAXPARAMLEN) {
error = EINVAL;
goto diag_done;
}
req.in_param = malloc(r->in_param_len, M_DEVBUF, M_WAITOK);
if(!req.in_param)

5
sys/kern/vfs_export.c
View File

@ -44,6 +44,7 @@
#include <sys/kernel.h>
#include <sys/socket.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/mount.h>
#include <net/radix.h>
#include <sys/domain.h>
@ -106,6 +107,10 @@ vfs_hang_addrlist(mp, nep, argp)
mp->mnt_flag |= MNT_DEFEXPORTED;
return (0);
}
if (argp->ex_addrlen > MLEN)
return (EINVAL);
i = sizeof(struct netcred) + argp->ex_addrlen + argp->ex_masklen;
np = (struct netcred *) malloc(i, M_NETADDR, M_WAITOK | M_ZERO);
saddr = (struct sockaddr *) (np + 1);

3
sys/net/if_ppp.c
View File

@ -345,7 +345,8 @@ pppioctl(sc, cmd, data, flag, p)
int flag;
struct proc *p;
{
int s, flags, mru, nb, npx;
int s, flags, mru, npx;
u_int nb;
int error = 0;
struct ppp_option_data *odp;
struct compressor **cp;

8
sys/nfs/nfs.h
View File

@ -198,9 +198,9 @@ struct nfsd_srvargs {
uid_t nsd_uid; /* Effective uid mapped to cred */
u_int32_t nsd_haddr; /* Ip address of client */
struct xucred nsd_cr; /* Cred. uid maps to */
int nsd_authlen; /* Length of auth string (ret) */
u_int nsd_authlen; /* Length of auth string (ret) */
u_char *nsd_authstr; /* Auth string (ret) */
int nsd_verflen; /* and the verfier */
u_int nsd_verflen; /* and the verfier */
u_char *nsd_verfstr;
struct timeval nsd_timestamp; /* timestamp from verifier */
u_int32_t nsd_ttl; /* credential ttl (sec) */
@ -211,9 +211,9 @@ struct nfsd_cargs {
char *ncd_dirp; /* Mount dir path */
uid_t ncd_authuid; /* Effective uid */
int ncd_authtype; /* Type of authenticator */
int ncd_authlen; /* Length of authenticator string */
u_int ncd_authlen; /* Length of authenticator string */
u_char *ncd_authstr; /* Authenticator string */
int ncd_verflen; /* and the verifier */
u_int ncd_verflen; /* and the verifier */
u_char *ncd_verfstr;
NFSKERBKEY_T ncd_key; /* Session key */
};

8
sys/nfsclient/nfs.h
View File

@ -198,9 +198,9 @@ struct nfsd_srvargs {
uid_t nsd_uid; /* Effective uid mapped to cred */
u_int32_t nsd_haddr; /* Ip address of client */
struct xucred nsd_cr; /* Cred. uid maps to */
int nsd_authlen; /* Length of auth string (ret) */
u_int nsd_authlen; /* Length of auth string (ret) */
u_char *nsd_authstr; /* Auth string (ret) */
int nsd_verflen; /* and the verfier */
u_int nsd_verflen; /* and the verfier */
u_char *nsd_verfstr;
struct timeval nsd_timestamp; /* timestamp from verifier */
u_int32_t nsd_ttl; /* credential ttl (sec) */
@ -211,9 +211,9 @@ struct nfsd_cargs {
char *ncd_dirp; /* Mount dir path */
uid_t ncd_authuid; /* Effective uid */
int ncd_authtype; /* Type of authenticator */
int ncd_authlen; /* Length of authenticator string */
u_int ncd_authlen; /* Length of authenticator string */
u_char *ncd_authstr; /* Authenticator string */
int ncd_verflen; /* and the verifier */
u_int ncd_verflen; /* and the verifier */
u_char *ncd_verfstr;
NFSKERBKEY_T ncd_key; /* Session key */
};

8
sys/nfsclient/nfsargs.h
View File

@ -198,9 +198,9 @@ struct nfsd_srvargs {
uid_t nsd_uid; /* Effective uid mapped to cred */
u_int32_t nsd_haddr; /* Ip address of client */
struct xucred nsd_cr; /* Cred. uid maps to */
int nsd_authlen; /* Length of auth string (ret) */
u_int nsd_authlen; /* Length of auth string (ret) */
u_char *nsd_authstr; /* Auth string (ret) */
int nsd_verflen; /* and the verfier */
u_int nsd_verflen; /* and the verfier */
u_char *nsd_verfstr;
struct timeval nsd_timestamp; /* timestamp from verifier */
u_int32_t nsd_ttl; /* credential ttl (sec) */
@ -211,9 +211,9 @@ struct nfsd_cargs {
char *ncd_dirp; /* Mount dir path */
uid_t ncd_authuid; /* Effective uid */
int ncd_authtype; /* Type of authenticator */
int ncd_authlen; /* Length of authenticator string */
u_int ncd_authlen; /* Length of authenticator string */
u_char *ncd_authstr; /* Authenticator string */
int ncd_verflen; /* and the verifier */
u_int ncd_verflen; /* and the verifier */
u_char *ncd_verfstr;
NFSKERBKEY_T ncd_key; /* Session key */
};

8
sys/nfsclient/nfsstats.h
View File

@ -198,9 +198,9 @@ struct nfsd_srvargs {
uid_t nsd_uid; /* Effective uid mapped to cred */
u_int32_t nsd_haddr; /* Ip address of client */
struct xucred nsd_cr; /* Cred. uid maps to */
int nsd_authlen; /* Length of auth string (ret) */
u_int nsd_authlen; /* Length of auth string (ret) */
u_char *nsd_authstr; /* Auth string (ret) */
int nsd_verflen; /* and the verfier */
u_int nsd_verflen; /* and the verfier */
u_char *nsd_verfstr;
struct timeval nsd_timestamp; /* timestamp from verifier */
u_int32_t nsd_ttl; /* credential ttl (sec) */
@ -211,9 +211,9 @@ struct nfsd_cargs {
char *ncd_dirp; /* Mount dir path */
uid_t ncd_authuid; /* Effective uid */
int ncd_authtype; /* Type of authenticator */
int ncd_authlen; /* Length of authenticator string */
u_int ncd_authlen; /* Length of authenticator string */
u_char *ncd_authstr; /* Authenticator string */
int ncd_verflen; /* and the verifier */
u_int ncd_verflen; /* and the verifier */
u_char *ncd_verfstr;
NFSKERBKEY_T ncd_key; /* Session key */
};

8
sys/nfsserver/nfs.h
View File

@ -198,9 +198,9 @@ struct nfsd_srvargs {
uid_t nsd_uid; /* Effective uid mapped to cred */
u_int32_t nsd_haddr; /* Ip address of client */
struct xucred nsd_cr; /* Cred. uid maps to */
int nsd_authlen; /* Length of auth string (ret) */
u_int nsd_authlen; /* Length of auth string (ret) */
u_char *nsd_authstr; /* Auth string (ret) */
int nsd_verflen; /* and the verfier */
u_int nsd_verflen; /* and the verfier */
u_char *nsd_verfstr;
struct timeval nsd_timestamp; /* timestamp from verifier */
u_int32_t nsd_ttl; /* credential ttl (sec) */
@ -211,9 +211,9 @@ struct nfsd_cargs {
char *ncd_dirp; /* Mount dir path */
uid_t ncd_authuid; /* Effective uid */
int ncd_authtype; /* Type of authenticator */
int ncd_authlen; /* Length of authenticator string */
u_int ncd_authlen; /* Length of authenticator string */
u_char *ncd_authstr; /* Authenticator string */
int ncd_verflen; /* and the verifier */
u_int ncd_verflen; /* and the verifier */
u_char *ncd_verfstr;
NFSKERBKEY_T ncd_key; /* Session key */
};

8
sys/nfsserver/nfsrvstats.h
View File

@ -198,9 +198,9 @@ struct nfsd_srvargs {
uid_t nsd_uid; /* Effective uid mapped to cred */
u_int32_t nsd_haddr; /* Ip address of client */
struct xucred nsd_cr; /* Cred. uid maps to */
int nsd_authlen; /* Length of auth string (ret) */
u_int nsd_authlen; /* Length of auth string (ret) */
u_char *nsd_authstr; /* Auth string (ret) */
int nsd_verflen; /* and the verfier */
u_int nsd_verflen; /* and the verfier */
u_char *nsd_verfstr;
struct timeval nsd_timestamp; /* timestamp from verifier */
u_int32_t nsd_ttl; /* credential ttl (sec) */
@ -211,9 +211,9 @@ struct nfsd_cargs {
char *ncd_dirp; /* Mount dir path */
uid_t ncd_authuid; /* Effective uid */
int ncd_authtype; /* Type of authenticator */
int ncd_authlen; /* Length of authenticator string */
u_int ncd_authlen; /* Length of authenticator string */
u_char *ncd_authstr; /* Authenticator string */
int ncd_verflen; /* and the verifier */
u_int ncd_verflen; /* and the verifier */
u_char *ncd_verfstr;
NFSKERBKEY_T ncd_key; /* Session key */
};

5
sys/sys/ccdvar.h
View File

@ -90,7 +90,7 @@
*/
struct ccd_ioctl {
char **ccio_disks; /* pointer to component paths */
int ccio_ndisks; /* number of disks to concatenate */
u_int ccio_ndisks; /* number of disks to concatenate */
int ccio_ileave; /* interleave (DEV_BSIZE blocks) */
int ccio_flags; /* misc. information */
int ccio_unit; /* unit number: use varies */
@ -167,7 +167,8 @@ struct ccd_s {
int sc_cflags; /* configuration flags */
size_t sc_size; /* size of ccd */
int sc_ileave; /* interleave */
int sc_nccdisks; /* number of components */
u_int sc_nccdisks; /* number of components */
#define CCD_MAXNDISKS 65536
struct ccdcinfo *sc_cinfo; /* component info */
struct ccdiinfo *sc_itable; /* interleave table */
struct devstat device_stats; /* device statistics */