https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206551

--- Comment #1 from CTurt <[email protected]> ---
Sorry, made a mistake in my report.

Supplying a size of `-1` actually passes `0xffffffffffffffff` to `malloc` and
`copyin`.

However, since `malloc` truncates sizes to 32bit (at least version 9.0 did),
this will result in an allocation of `0xffffffff`, but copy length of
`0xffffffffffffffff`.

If there is enough memory for this allocation to succeed, a heap overflow will
occur.

-- 
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"

Reply via email to