https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216939
Bug ID: 216939
Summary: A buffer underflow in the ZFS implementation of
vop_vptocnp VFS method
Product: Base System
Version: 10.3-STABLE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 179795
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=179795&action=edit
This patch adds check for remaining buffer space. ENOMEM will be returned when
buffer too small.
ZFS implementation the vop_vptocnp VFS method doesn't check for remaining
buffer space. So some memory before the begin of buffer may be overwritten.
Also negative buffer length may be returned. This affects at least
kern___getcwd function on 64-bit platforms. Buffer length in vn_fullpath1 used
by kern___getcwd have declared as unsigned int, so '/' char may be written far
beyond the end of the buffer.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
