Module Name: src Committed By: uwe Date: Wed Jun 13 02:09:09 UTC 2018
Modified Files: src/sys/dev/wscons: wsevent.c Log Message: wsevent_copyout_events50 - don't leak garbage from the kernel stack. On 64-bit machines struct timespec50 has padding between 32-bit tv_sec and long tv_nsec that is not affected by normal assignment. Scrub it before we uiomove struct owscons_event. To generate a diff of this commit: cvs rdiff -u -r1.37 -r1.38 src/sys/dev/wscons/wsevent.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/wscons/wsevent.c diff -u src/sys/dev/wscons/wsevent.c:1.37 src/sys/dev/wscons/wsevent.c:1.38 --- src/sys/dev/wscons/wsevent.c:1.37 Wed Oct 25 08:12:39 2017 +++ src/sys/dev/wscons/wsevent.c Wed Jun 13 02:09:09 2018 @@ -1,4 +1,4 @@ -/* $NetBSD: wsevent.c,v 1.37 2017/10/25 08:12:39 maya Exp $ */ +/* $NetBSD: wsevent.c,v 1.38 2018/06/13 02:09:09 uwe Exp $ */ /*- * Copyright (c) 2006, 2008 The NetBSD Foundation, Inc. @@ -104,7 +104,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: wsevent.c,v 1.37 2017/10/25 08:12:39 maya Exp $"); +__KERNEL_RCSID(0, "$NetBSD: wsevent.c,v 1.38 2018/06/13 02:09:09 uwe Exp $"); #ifdef _KERNEL_OPT #include "opt_compat_netbsd.h" @@ -202,6 +202,9 @@ wsevent_copyout_events50(const struct ws ev50.type = ev->type; ev50.value = ev->value; +#if INT32_MAX < LONG_MAX /* scrub padding */ + memset(&ev50.time, 0, offsetof(struct timespec50, tv_nsec)); +#endif timespec_to_timespec50(&ev->time, &ev50.time); error = uiomove(&ev50, sizeof(ev50), uio);