CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/27 04:47:23
Modified files:
sys/kern : Tag: OPENBSD_7_9 kern_sysctl.c
Log message:
In sysctl KERN_PROC_ARGS "cnt" is an int, read directly from a userspace
process. The while loop has a "cnt > 0" check, but on 32-bit platforms a value
can overflow and result in the querying process having data written past the
supplied buffer. Limit the number of elements in the array to ARG_MAX.
from dgl@; OK deraadt@
this is errata/7.9/025_procargs.patch.sig
