Author: gordon
Date: Thu Sep 27 18:54:41 2018
New Revision: 338987
URL: https://svnweb.freebsd.org/changeset/base/338987
Log:
Check to ensure the buffer returned is not NULL.
Direct commit to the branch as this behavior is only seeing in stable/11.
Reported by: Thomas Barabosch, Fraunhofer FKIE
Reviewed by: wes@
Approved by: so
Security: FreeBSD-EN-18:10.syscall
Security: CVE-2018-17154
Modified:
stable/11/sys/kern/vfs_syscalls.c
Modified: stable/11/sys/kern/vfs_syscalls.c
==============================================================================
--- stable/11/sys/kern/vfs_syscalls.c Thu Sep 27 18:50:10 2018
(r338986)
+++ stable/11/sys/kern/vfs_syscalls.c Thu Sep 27 18:54:41 2018
(r338987)
@@ -601,6 +601,8 @@ freebsd4_getfsstat(struct thread *td, struct freebsd4_
size = count * sizeof(struct statfs);
error = kern_getfsstat(td, &buf, size, &count, UIO_SYSSPACE,
uap->mode);
+ if (buf == NULL)
+ return (EINVAL);
td->td_retval[0] = count;
if (size != 0) {
sp = buf;
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
