Module Name:    src
Committed By:   snj
Date:           Sat Aug 12 04:09:05 UTC 2017

Modified Files:
        src/sys/compat/ibcs2 [netbsd-7-1]: ibcs2_exec_coff.c ibcs2_ioctl.c
            ibcs2_stat.c

Log Message:
Pull up following revision(s) (requested by mrg in ticket #1477):
        sys/compat/ibcs2/ibcs2_exec_coff.c: revision 1.27-1.29
        sys/compat/ibcs2/ibcs2_ioctl.c: revision 1.46
        sys/compat/ibcs2/ibcs2_stat.c: revision 1.49-1.50
Check for NUL termination within the buffer we have.
>From Ilja Van Sprundel.
--
Make sure we have enough space in the buffer before reading it.
>From Ilja Van Sprundel.
--
Make sure we move forward over the buffer.
>From Ilja Van Sprundel.
--
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.
>From Ilja Van Sprundel.
--
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.
Nothing else guarantees the mount will stick around.
>From Ilja Van Sprundel.
--
Little happy on the commit trigger.  Actually use the out label.


To generate a diff of this commit:
cvs rdiff -u -r1.26 -r1.26.16.1 src/sys/compat/ibcs2/ibcs2_exec_coff.c
cvs rdiff -u -r1.45 -r1.45.70.1 src/sys/compat/ibcs2/ibcs2_ioctl.c
cvs rdiff -u -r1.47 -r1.47.44.1 src/sys/compat/ibcs2/ibcs2_stat.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26.16.1
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26	Fri Oct 25 14:46:35 2013
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c	Sat Aug 12 04:09:05 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $	*/
+/*	$NetBSD: ibcs2_exec_coff.c,v 1.26.16.1 2017/08/12 04:09:05 snj Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26.16.1 2017/08/12 04:09:05 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -454,6 +454,10 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 		}
 		bufp = tbuf;
 		while (len) {
+			if (len < sizeof(struct coff_slhdr)) {
+				free(tbuf, M_TEMP);
+				return ENOEXEC;
+			}
 			slhdr = (struct coff_slhdr *)bufp;
 
 			if (slhdr->path_index > LONG_MAX / sizeof(long) ||
@@ -465,7 +469,9 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
 			/* path_index = slhdr->path_index * sizeof(long); */
 			entry_len = slhdr->entry_len * sizeof(long);
 
-			if (entry_len > len) {
+			if (entry_len < sizeof(struct coff_slhdr) ||
+			    entry_len > len ||
+			    strnlen(slhdr->sl_name, entry_len) == entry_len) {
 				free(tbuf, M_TEMP);
 				return ENOEXEC;
 			}

Index: src/sys/compat/ibcs2/ibcs2_ioctl.c
diff -u src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45 src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45.70.1
--- src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45	Tue Jun 24 10:03:17 2008
+++ src/sys/compat/ibcs2/ibcs2_ioctl.c	Sat Aug 12 04:09:05 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $	*/
+/*	$NetBSD: ibcs2_ioctl.c,v 1.45.70.1 2017/08/12 04:09:05 snj Exp $	*/
 
 /*
  * Copyright (c) 1994, 1995 Scott Bartram
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45.70.1 2017/08/12 04:09:05 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -402,8 +402,10 @@ ibcs2_sys_ioctl(struct lwp *l, const str
 		if ((error = (*ctl)(fp, TIOCGETA, &bts)) != 0)
 			goto out;
 
+		memset(&sts, 0, sizeof(sts));
 		btios2stios(&bts, &sts);
 		if (SCARG(uap, cmd) == IBCS2_TCGETA) {
+			memset(&st, 0, sizeof(st));
 			stios2stio(&sts, &st);
 			error = copyout(&st, SCARG(uap, data), sizeof(st));
 			if (error)
@@ -559,6 +561,7 @@ ibcs2_sys_gtty(struct lwp *l, const stru
 
 	fd_putfile(SCARG(uap, fd));
 
+	memset(&itb, 0, sizeof(itb));
 	itb.sg_ispeed = tb.sg_ispeed;
 	itb.sg_ospeed = tb.sg_ospeed;
 	itb.sg_erase = tb.sg_erase;

Index: src/sys/compat/ibcs2/ibcs2_stat.c
diff -u src/sys/compat/ibcs2/ibcs2_stat.c:1.47 src/sys/compat/ibcs2/ibcs2_stat.c:1.47.44.1
--- src/sys/compat/ibcs2/ibcs2_stat.c:1.47	Mon Jun 29 05:08:16 2009
+++ src/sys/compat/ibcs2/ibcs2_stat.c	Sat Aug 12 04:09:05 2017
@@ -1,4 +1,4 @@
-/*	$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $	*/
+/*	$NetBSD: ibcs2_stat.c,v 1.47.44.1 2017/08/12 04:09:05 snj Exp $	*/
 /*
  * Copyright (c) 1995, 1998 Scott Bartram
  * All rights reserved.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47.44.1 2017/08/12 04:09:05 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -147,11 +147,13 @@ ibcs2_sys_statfs(struct lwp *l, const st
 		return (error);
 	mp = vp->v_mount;
 	sp = &mp->mnt_stat;
-	vrele(vp);
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
-		return (error);
+		goto out;
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-	return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+	error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+out:
+	vrele(vp);
+	return (error);
 }
 
 int
@@ -200,12 +202,14 @@ ibcs2_sys_statvfs(struct lwp *l, const s
 		return (error);
 	mp = vp->v_mount;
 	sp = &mp->mnt_stat;
-	vrele(vp);
 	if ((error = VFS_STATVFS(mp, sp)) != 0)
-		return (error);
+		goto out;
 	sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
-	return cvt_statvfs(sp, (void *)SCARG(uap, buf),
-			   sizeof(struct ibcs2_statvfs));
+	error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
+	    sizeof(struct ibcs2_statvfs));
+out:
+	vrele(vp);
+	return error;
 }
 
 int

Reply via email to