Sat Aug 19 04:13:52 2017 UTC ()
Pull up following revision(s) (requested by mrg in ticket #1481):
sys/compat/ibcs2/ibcs2_exec_coff.c: 1.27-1.29
sys/compat/ibcs2/ibcs2_ioctl.c: 1.46
sys/compat/ibcs2/ibcs2_stat.c: 1.49-1.50
Check for NUL termination within the buffer we have.
From Ilja Van Sprundel.
--
Make sure we have enough space in the buffer before reading it.
From Ilja Van Sprundel.
--
Make sure we move forward over the buffer.
From Ilja Van Sprundel.
--
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.
From Ilja Van Sprundel.
--
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.
Nothing else guarantees the mount will stick around.
From Ilja Van Sprundel.
--
Little happy on the commit trigger. Actually use the out label.
(snj)
diff -r1.25 -r1.25.14.1 src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -r1.45 -r1.45.36.1 src/sys/compat/ibcs2/ibcs2_ioctl.c
diff -r1.47 -r1.47.18.1 src/sys/compat/ibcs2/ibcs2_stat.c
--- src/sys/compat/ibcs2/Attic/ibcs2_exec_coff.c 2010/07/22 03:19:02 1.25
+++ src/sys/compat/ibcs2/Attic/ibcs2_exec_coff.c 2017/08/19 04:13:51 1.25.14.1
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_exec_coff.c,v 1.25 2010/07/22 03:19:02 christos Exp $ */
+/* $NetBSD: ibcs2_exec_coff.c,v 1.25.14.1 2017/08/19 04:13:51 snj Exp $ */
/*
* Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.25 2010/07/22 03:19:02 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.25.14.1 2017/08/19 04:13:51 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -454,6 +454,10 @@
}
bufp = tbuf;
while (len) {
+ if (len < sizeof(struct coff_slhdr)) {
+ free(tbuf, M_TEMP);
+ return ENOEXEC;
+ }
slhdr = (struct coff_slhdr *)bufp;
if (slhdr->path_index > LONG_MAX / sizeof(long) ||
@@ -465,7 +469,9 @@
path_index = slhdr->path_index * sizeof(long);
entry_len = slhdr->entry_len * sizeof(long);
- if (entry_len > len) {
+ if (entry_len < sizeof(struct coff_slhdr) ||
+ entry_len > len ||
+ strnlen(slhdr->sl_name, entry_len) == entry_len) {
free(tbuf, M_TEMP);
return ENOEXEC;
}
--- src/sys/compat/ibcs2/Attic/ibcs2_ioctl.c 2008/06/24 10:03:17 1.45
+++ src/sys/compat/ibcs2/Attic/ibcs2_ioctl.c 2017/08/19 04:13:51 1.45.36.1
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $ */
+/* $NetBSD: ibcs2_ioctl.c,v 1.45.36.1 2017/08/19 04:13:51 snj Exp $ */
/*
* Copyright (c) 1994, 1995 Scott Bartram
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45.36.1 2017/08/19 04:13:51 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -402,8 +402,10 @@
if ((error = (*ctl)(fp, TIOCGETA, &bts)) != 0)
goto out;
+ memset(&sts, 0, sizeof(sts));
btios2stios(&bts, &sts);
if (SCARG(uap, cmd) == IBCS2_TCGETA) {
+ memset(&st, 0, sizeof(st));
stios2stio(&sts, &st);
error = copyout(&st, SCARG(uap, data), sizeof(st));
if (error)
@@ -559,6 +561,7 @@
fd_putfile(SCARG(uap, fd));
+ memset(&itb, 0, sizeof(itb));
itb.sg_ispeed = tb.sg_ispeed;
itb.sg_ospeed = tb.sg_ospeed;
itb.sg_erase = tb.sg_erase;
--- src/sys/compat/ibcs2/Attic/ibcs2_stat.c 2009/06/29 05:08:16 1.47
+++ src/sys/compat/ibcs2/Attic/ibcs2_stat.c 2017/08/19 04:13:51 1.47.18.1
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $ */
+/* $NetBSD: ibcs2_stat.c,v 1.47.18.1 2017/08/19 04:13:51 snj Exp $ */
/*
* Copyright (c) 1995, 1998 Scott Bartram
* All rights reserved.
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47.18.1 2017/08/19 04:13:51 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -147,11 +147,13 @@
return (error);
mp = vp->v_mount;
sp = &mp->mnt_stat;
- vrele(vp);
if ((error = VFS_STATVFS(mp, sp)) != 0)
- return (error);
+ goto out;
sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
- return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+ error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+out:
+ vrele(vp);
+ return (error);
}
int
@@ -200,12 +202,14 @@
return (error);
mp = vp->v_mount;
sp = &mp->mnt_stat;
- vrele(vp);
if ((error = VFS_STATVFS(mp, sp)) != 0)
- return (error);
+ goto out;
sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
- return cvt_statvfs(sp, (void *)SCARG(uap, buf),
- sizeof(struct ibcs2_statvfs));
+ error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
+ sizeof(struct ibcs2_statvfs));
+out:
+ vrele(vp);
+ return error;
}
int