Module Name: src
Committed By: christos
Date: Thu Jan 30 14:07:40 UTC 2020
Modified Files:
src/sys/compat/common: kern_info_43.c
Log Message:
- make sure size is not used uninitialized
- limit size range
- fix type botch for "size"
from maxv@
To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.39 src/sys/compat/common/kern_info_43.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/common/kern_info_43.c
diff -u src/sys/compat/common/kern_info_43.c:1.38 src/sys/compat/common/kern_info_43.c:1.39
--- src/sys/compat/common/kern_info_43.c:1.38 Thu Jan 2 10:42:26 2020
+++ src/sys/compat/common/kern_info_43.c Thu Jan 30 09:07:40 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_info_43.c,v 1.38 2020/01/02 15:42:26 thorpej Exp $ */
+/* $NetBSD: kern_info_43.c,v 1.39 2020/01/30 14:07:40 christos Exp $ */
/*
* Copyright (c) 1982, 1986, 1991, 1993
@@ -32,7 +32,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_info_43.c,v 1.38 2020/01/02 15:42:26 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_info_43.c,v 1.39 2020/01/30 14:07:40 christos Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h"
@@ -172,11 +172,19 @@ compat_43_sys_getkerninfo(struct lwp *l,
syscallarg(int) arg;
} */
int error, name[6];
+ int isize;
size_t size;
- if (SCARG(uap, size) && (error = copyin((void *)SCARG(uap, size),
- (void *)&size, sizeof(size))))
- return (error);
+ if (!SCARG(uap, size))
+ return EINVAL;
+
+ if ((error = copyin(SCARG(uap, size), &isize, sizeof(isize))) != 0)
+ return error;
+
+ if (isize < 0 || isize > 4096)
+ return EINVAL;
+
+ size = isize;
switch (SCARG(uap, op) & 0xff00) {
