Module Name: src
Committed By: snj
Date: Mon Mar 7 17:07:17 UTC 2011
Modified Files:
src/sys/kern [netbsd-4]: init_sysctl.c
Log Message:
Apply patch (requested by joerg in ticket 1419):
Sanitize arguments before memory allocation.
To generate a diff of this commit:
cvs rdiff -u -r1.93.2.2 -r1.93.2.3 src/sys/kern/init_sysctl.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/init_sysctl.c
diff -u src/sys/kern/init_sysctl.c:1.93.2.2 src/sys/kern/init_sysctl.c:1.93.2.3
--- src/sys/kern/init_sysctl.c:1.93.2.2 Fri Mar 20 15:06:17 2009
+++ src/sys/kern/init_sysctl.c Mon Mar 7 17:07:17 2011
@@ -1,4 +1,4 @@
-/* $NetBSD: init_sysctl.c,v 1.93.2.2 2009/03/20 15:06:17 msaitoh Exp $ */
+/* $NetBSD: init_sysctl.c,v 1.93.2.3 2011/03/07 17:07:17 snj Exp $ */
/*-
* Copyright (c) 2003 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.93.2.2 2009/03/20 15:06:17 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.93.2.3 2011/03/07 17:07:17 snj Exp $");
#include "opt_sysv.h"
#include "opt_multiprocessor.h"
@@ -2296,6 +2296,11 @@
#endif
len = sizeof(char *) * nargv;
+ if (nargv < 0 || len > ARG_MAX || len < (size_t)nargv) {
+ error = EINVAL;
+ goto done;
+ }
+
argv = malloc(len, M_TEMP, M_WAITOK);
aiov.iov_base = argv;
