CVS commit: [netbsd-5] src/sys/kern

[Soren Jacobsen]

Module Name:    src
Committed By:   snj
Date:           Mon Mar  7 17:08:28 UTC 2011

Modified Files:
        src/sys/kern [netbsd-5]: init_sysctl.c

Log Message:
Apply patch (requested by joerg in ticket 1575):
Sanitize arguments before memory allocation.


To generate a diff of this commit:
cvs rdiff -u -r1.149.4.7 -r1.149.4.8 src/sys/kern/init_sysctl.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/kern/init_sysctl.c
diff -u src/sys/kern/init_sysctl.c:1.149.4.7 src/sys/kern/init_sysctl.c:1.149.4.8
--- src/sys/kern/init_sysctl.c:1.149.4.7	Wed Jul  1 22:42:28 2009
+++ src/sys/kern/init_sysctl.c	Mon Mar  7 17:08:28 2011
@@ -1,4 +1,4 @@
-/*	$NetBSD: init_sysctl.c,v 1.149.4.7 2009/07/01 22:42:28 snj Exp $ */
+/*	$NetBSD: init_sysctl.c,v 1.149.4.8 2011/03/07 17:08:28 snj Exp $ */
 
 /*-
  * Copyright (c) 2003, 2007, 2008 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.149.4.7 2009/07/01 22:42:28 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: init_sysctl.c,v 1.149.4.8 2011/03/07 17:08:28 snj Exp $");
 
 #include "opt_sysv.h"
 #include "opt_compat_netbsd32.h"
@@ -2528,6 +2528,11 @@
 #endif
 		len = sizeof(char *) * nargv;
 
+	if (nargv < 0 || len > ARG_MAX || len < (size_t)nargv) {
+		error = EINVAL;
+		goto done;
+	}
+
 	if ((argvlen = len) != 0)
 		argv = kmem_alloc(len, KM_SLEEP);