CVS commit: src/sys/compat/ibcs2

[Taylor R Campbell]

Module Name:    src
Committed By:   riastradh
Date:           Fri Jul 28 15:47:23 UTC 2017

Modified Files:
        src/sys/compat/ibcs2: ibcs2_exec_coff.c

Log Message:
Check for NUL termination within the buffer we have.

>From Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.26 -r1.27 src/sys/compat/ibcs2/ibcs2_exec_coff.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.27
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26	Fri Oct 25 14:46:35 2013
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c	Fri Jul 28 15:47:23 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $	*/
+/*	$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -465,7 +465,8 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 			/* path_index = slhdr->path_index * sizeof(long); */
 			entry_len = slhdr->entry_len * sizeof(long);
 
-			if (entry_len > len) {
+			if (entry_len > len ||
+			    strnlen(slhdr->sl_name, entry_len) == entry_len) {
 				free(tbuf, M_TEMP);
 				return ENOEXEC;
 			}