Module Name: src
Committed By: riastradh
Date: Fri Jul 28 15:51:35 UTC 2017
Modified Files:
src/sys/compat/ibcs2: ibcs2_exec_coff.c
Log Message:
Make sure we move forward over the buffer.
>From Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 src/sys/compat/ibcs2/ibcs2_exec_coff.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.28 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.29
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.28 Fri Jul 28 15:50:04 2017
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c Fri Jul 28 15:51:35 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $ */
+/* $NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $ */
/*
* Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -469,7 +469,8 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
/* path_index = slhdr->path_index * sizeof(long); */
entry_len = slhdr->entry_len * sizeof(long);
- if (entry_len > len ||
+ if (entry_len < sizeof(struct coff_slhdr) ||
+ entry_len > len ||
strnlen(slhdr->sl_name, entry_len) == entry_len) {
free(tbuf, M_TEMP);
return ENOEXEC;
