CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/09/19 11:29:23
Modified files:
sys/kern : kern_sysctl.c
Log message:
In sysctl KERN_PROC_ARGS "cnt" is an int, read directly from a userspace
process. The while loop has a "cnt > 0" check, but on 32-bit platforms a value
can overflow and result in the querying process having data written past the
supplied buffer. Limit the number of elements in the array to ARG_MAX.
ok deraadt@
