d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

When user specifies the bootcode with size smaller than VTOC_BOOTCODE,

Browse Source 
gpart_write_partcode_vtoc8 does access out of range of allocated memory.
Check size of bootcode before writing it.

Pointed out by:		ru
MFC after:		1 week
This commit is contained in:
ae 2011-06-21 10:35:20 +00:00
parent a8e6967ab3
commit c0d149ddb3
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sbin/geom/class/part/geom_part.c
View File

@ -1208,8 +1208,11 @@ gpart_bootcode(struct gctl_req *req, unsigned int fl)
if (idx == 0)
errx(EXIT_FAILURE, "missing -i option");
gpart_write_partcode(gp, idx, partcode, partsize);
} else
} else {
if (partsize != VTOC_BOOTSIZE)
errx(EXIT_FAILURE, "invalid bootcode");
gpart_write_partcode_vtoc8(gp, idx, partcode);
}
} else
if (bootcode == NULL)
errx(EXIT_FAILURE, "no -b nor -p");