Author: glebius
Date: Tue Oct 25 17:11:02 2016
New Revision: 307931
URL: https://svnweb.freebsd.org/changeset/base/307931
Log:
Revised SA-16:15. The initial patch didn't cover all possible overflows
based on passing incorrect parameters to sysarch(2).
Security: SA-16:15
Approved by: so
Modified:
releng/9.3/UPDATING
releng/9.3/sys/amd64/amd64/sys_machdep.c
releng/9.3/sys/conf/newvers.sh
Modified: releng/9.3/UPDATING
==============================================================================
--- releng/9.3/UPDATING Tue Oct 25 16:50:10 2016 (r307930)
+++ releng/9.3/UPDATING Tue Oct 25 17:11:02 2016 (r307931)
@@ -11,6 +11,10 @@ handbook:
Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running portupgrade.
+20161025 p49 FreeBSD-SA-16:15.sysarch [revised]
+
+ Fix incorrect argument validation in sysarch(2). [SA-16:15]
+
20161010 p48 FreeBSD-SA-16:28.bind
FreeBSD-SA-16:29.bspatch
FreeBSD-SA-16:30.portsnap
Modified: releng/9.3/sys/amd64/amd64/sys_machdep.c
==============================================================================
--- releng/9.3/sys/amd64/amd64/sys_machdep.c Tue Oct 25 16:50:10 2016
(r307930)
+++ releng/9.3/sys/amd64/amd64/sys_machdep.c Tue Oct 25 17:11:02 2016
(r307931)
@@ -612,6 +612,8 @@ amd64_set_ldt(td, uap, descs)
largest_ld = uap->start + uap->num;
if (largest_ld > max_ldt_segment)
largest_ld = max_ldt_segment;
+ if (largest_ld < uap->start)
+ return (EINVAL);
i = largest_ld - uap->start;
mtx_lock(&dt_lock);
bzero(&((struct user_segment_descriptor *)(pldt->ldt_base))
@@ -624,7 +626,8 @@ amd64_set_ldt(td, uap, descs)
/* verify range of descriptors to modify */
largest_ld = uap->start + uap->num;
if (uap->start >= max_ldt_segment ||
- largest_ld > max_ldt_segment)
+ largest_ld > max_ldt_segment ||
+ largest_ld < uap->start)
return (EINVAL);
}
Modified: releng/9.3/sys/conf/newvers.sh
==============================================================================
--- releng/9.3/sys/conf/newvers.sh Tue Oct 25 16:50:10 2016
(r307930)
+++ releng/9.3/sys/conf/newvers.sh Tue Oct 25 17:11:02 2016
(r307931)
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="9.3"
-BRANCH="RELEASE-p48"
+BRANCH="RELEASE-p49"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
