Module Name: src
Committed By: snj
Date: Sat Aug 12 04:08:26 UTC 2017
Modified Files:
src/sys/compat/ibcs2 [netbsd-7-0]: ibcs2_exec_coff.c ibcs2_ioctl.c
ibcs2_stat.c
Log Message:
Pull up following revision(s) (requested by mrg in ticket #1477):
sys/compat/ibcs2/ibcs2_exec_coff.c: revision 1.27-1.29
sys/compat/ibcs2/ibcs2_ioctl.c: revision 1.46
sys/compat/ibcs2/ibcs2_stat.c: revision 1.49-1.50
Check for NUL termination within the buffer we have.
>From Ilja Van Sprundel.
--
Make sure we have enough space in the buffer before reading it.
>From Ilja Van Sprundel.
--
Make sure we move forward over the buffer.
>From Ilja Van Sprundel.
--
Zero buffers in ibcs2 ioctl to avoid disclosing stack to userland.
>From Ilja Van Sprundel.
--
Don't drop vnode ref until we're done with mount in ibcs2_stat(v)fs.
Nothing else guarantees the mount will stick around.
>From Ilja Van Sprundel.
--
Little happy on the commit trigger. Actually use the out label.
To generate a diff of this commit:
cvs rdiff -u -r1.26 -r1.26.8.1 src/sys/compat/ibcs2/ibcs2_exec_coff.c
cvs rdiff -u -r1.45 -r1.45.62.1 src/sys/compat/ibcs2/ibcs2_ioctl.c
cvs rdiff -u -r1.47 -r1.47.40.1 src/sys/compat/ibcs2/ibcs2_stat.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/compat/ibcs2/ibcs2_exec_coff.c
diff -u src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26 src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26.8.1
--- src/sys/compat/ibcs2/ibcs2_exec_coff.c:1.26 Fri Oct 25 14:46:35 2013
+++ src/sys/compat/ibcs2/ibcs2_exec_coff.c Sat Aug 12 04:08:25 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $ */
+/* $NetBSD: ibcs2_exec_coff.c,v 1.26.8.1 2017/08/12 04:08:25 snj Exp $ */
/*
* Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26 2013/10/25 14:46:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.26.8.1 2017/08/12 04:08:25 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -454,6 +454,10 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
}
bufp = tbuf;
while (len) {
+ if (len < sizeof(struct coff_slhdr)) {
+ free(tbuf, M_TEMP);
+ return ENOEXEC;
+ }
slhdr = (struct coff_slhdr *)bufp;
if (slhdr->path_index > LONG_MAX / sizeof(long) ||
@@ -465,7 +469,9 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *
/* path_index = slhdr->path_index * sizeof(long); */
entry_len = slhdr->entry_len * sizeof(long);
- if (entry_len > len) {
+ if (entry_len < sizeof(struct coff_slhdr) ||
+ entry_len > len ||
+ strnlen(slhdr->sl_name, entry_len) == entry_len) {
free(tbuf, M_TEMP);
return ENOEXEC;
}
Index: src/sys/compat/ibcs2/ibcs2_ioctl.c
diff -u src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45 src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45.62.1
--- src/sys/compat/ibcs2/ibcs2_ioctl.c:1.45 Tue Jun 24 10:03:17 2008
+++ src/sys/compat/ibcs2/ibcs2_ioctl.c Sat Aug 12 04:08:25 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $ */
+/* $NetBSD: ibcs2_ioctl.c,v 1.45.62.1 2017/08/12 04:08:25 snj Exp $ */
/*
* Copyright (c) 1994, 1995 Scott Bartram
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45 2008/06/24 10:03:17 gmcgarry Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_ioctl.c,v 1.45.62.1 2017/08/12 04:08:25 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -402,8 +402,10 @@ ibcs2_sys_ioctl(struct lwp *l, const str
if ((error = (*ctl)(fp, TIOCGETA, &bts)) != 0)
goto out;
+ memset(&sts, 0, sizeof(sts));
btios2stios(&bts, &sts);
if (SCARG(uap, cmd) == IBCS2_TCGETA) {
+ memset(&st, 0, sizeof(st));
stios2stio(&sts, &st);
error = copyout(&st, SCARG(uap, data), sizeof(st));
if (error)
@@ -559,6 +561,7 @@ ibcs2_sys_gtty(struct lwp *l, const stru
fd_putfile(SCARG(uap, fd));
+ memset(&itb, 0, sizeof(itb));
itb.sg_ispeed = tb.sg_ispeed;
itb.sg_ospeed = tb.sg_ospeed;
itb.sg_erase = tb.sg_erase;
Index: src/sys/compat/ibcs2/ibcs2_stat.c
diff -u src/sys/compat/ibcs2/ibcs2_stat.c:1.47 src/sys/compat/ibcs2/ibcs2_stat.c:1.47.40.1
--- src/sys/compat/ibcs2/ibcs2_stat.c:1.47 Mon Jun 29 05:08:16 2009
+++ src/sys/compat/ibcs2/ibcs2_stat.c Sat Aug 12 04:08:25 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $ */
+/* $NetBSD: ibcs2_stat.c,v 1.47.40.1 2017/08/12 04:08:25 snj Exp $ */
/*
* Copyright (c) 1995, 1998 Scott Bartram
* All rights reserved.
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47 2009/06/29 05:08:16 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_stat.c,v 1.47.40.1 2017/08/12 04:08:25 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -147,11 +147,13 @@ ibcs2_sys_statfs(struct lwp *l, const st
return (error);
mp = vp->v_mount;
sp = &mp->mnt_stat;
- vrele(vp);
if ((error = VFS_STATVFS(mp, sp)) != 0)
- return (error);
+ goto out;
sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
- return cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+ error = cvt_statfs(sp, (void *)SCARG(uap, buf), SCARG(uap, len));
+out:
+ vrele(vp);
+ return (error);
}
int
@@ -200,12 +202,14 @@ ibcs2_sys_statvfs(struct lwp *l, const s
return (error);
mp = vp->v_mount;
sp = &mp->mnt_stat;
- vrele(vp);
if ((error = VFS_STATVFS(mp, sp)) != 0)
- return (error);
+ goto out;
sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
- return cvt_statvfs(sp, (void *)SCARG(uap, buf),
- sizeof(struct ibcs2_statvfs));
+ error = cvt_statvfs(sp, (void *)SCARG(uap, buf),
+ sizeof(struct ibcs2_statvfs));
+out:
+ vrele(vp);
+ return error;
}
int
