Module Name: src Committed By: sborrill Date: Mon Apr 28 16:06:47 UTC 2014
Modified Files: src/doc [netbsd-5-2]: CHANGES-5.2.3 Log Message: Ticket #1901 To generate a diff of this commit: cvs rdiff -u -r1.1.2.2 -r1.1.2.3 src/doc/CHANGES-5.2.3 Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/doc/CHANGES-5.2.3 diff -u src/doc/CHANGES-5.2.3:1.1.2.2 src/doc/CHANGES-5.2.3:1.1.2.3 --- src/doc/CHANGES-5.2.3:1.1.2.2 Wed Apr 16 06:57:19 2014 +++ src/doc/CHANGES-5.2.3 Mon Apr 28 16:06:47 2014 @@ -1,4 +1,4 @@ -# $NetBSD: CHANGES-5.2.3,v 1.1.2.2 2014/04/16 06:57:19 msaitoh Exp $ +# $NetBSD: CHANGES-5.2.3,v 1.1.2.3 2014/04/28 16:06:47 sborrill Exp $ A complete list of changes from the NetBSD 5.2.2 release to the NetBSD 5.2.3 release: @@ -14,3 +14,38 @@ sys/kern/kern_verifiedexec.c 1.132 Reorder code to avoid use-after-free on error. From Maxime Villard. [maxv, ticket #1899] + +sys/kern/vfs_syscalls.c 1.478, 1.480 via patch +sys/coda/coda_vfsops.c 1.81 +sys/fs/adosfs/advfsops.c 1.70 +sys/fs/cd9660/cd9660_vfsops.c 1.84 +sys/fs/efs/efs_vfsops.c 1.25 +sys/fs/filecorefs/filecore_vfsops.c 1.76 +sys/fs/hfs/hfs_vfsops.c 1.31 +sys/fs/msdosfs/msdosfs_vfsops.c 1.107 +sys/fs/ntfs/ntfs_vfsops.c 1.94 +sys/fs/ptyfs/ptyfs_vfsops.c 1.50 via patch +sys/fs/puffs/puffs_vfsops.c 1.110 via patch +sys/fs/smbfs/smbfs_vfsops.c 1.100 +sys/fs/sysvbfs/sysvbfs_vfsops.c 1.43 +sys/fs/tmpfs/tmpfs_vfsops.c 1.59 via patch +sys/fs/udf/udf_vfsops.c 1.67 +sys/fs/union/union_vfsops.c 1.72 +sys/fs/unionfs/unionfs_vfsops.c 1.13 +sys/kern/vfs_syscalls.c 1.479 +sys/miscfs/nullfs/null_vfsops.c 1.88 via patch +sys/miscfs/overlay/overlay_vfsops.c 1.61 +sys/miscfs/procfs/procfs_vfsops.c 1.91 +sys/miscfs/umapfs/umap_vfsops.c 1.92 +sys/nfs/nfs_vfsops.c 1.227 +sys/ufs/ext2fs/ext2fs_vfsops.c 1.180 +sys/ufs/ffs/ffs_vfsops.c 1.297 +sys/ufs/lfs/lfs_vfsops.c 1.321 +sys/ufs/mfs/mfs_vfsops.c 1.107 + + Due to missing checks in the mount syscall, and a wrong + assumption on the file systems side, the kernel could allocate + an unbounded or zero-sized memory buffer, and could dereference + a NULL pointer when particular arguments are given by a user. + [maxv, ticket #1901] +