Author: gordon
Date: Thu Sep 27 18:32:14 2018
New Revision: 338979
URL: https://svnweb.freebsd.org/changeset/base/338979
Log:
Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]
Reported by: Thomas Barabosch, Fraunhofer FKIE
Approved by: so
Security: FreeBSD-EN-18:10.syscall
Security: CVE-2018-17154
Modified:
releng/11.1/sys/kern/vfs_syscalls.c
releng/11.2/sys/kern/vfs_syscalls.c
Modified: releng/11.1/sys/kern/vfs_syscalls.c
==============================================================================
--- releng/11.1/sys/kern/vfs_syscalls.c Thu Sep 27 18:29:55 2018
(r338978)
+++ releng/11.1/sys/kern/vfs_syscalls.c Thu Sep 27 18:32:14 2018
(r338979)
@@ -641,6 +641,8 @@ freebsd4_getfsstat(td, uap)
size = count * sizeof(struct statfs);
error = kern_getfsstat(td, &buf, size, &count, UIO_SYSSPACE,
uap->mode);
+ if (buf == NULL)
+ return (EINVAL);
td->td_retval[0] = count;
if (size != 0) {
sp = buf;
Modified: releng/11.2/sys/kern/vfs_syscalls.c
==============================================================================
--- releng/11.2/sys/kern/vfs_syscalls.c Thu Sep 27 18:29:55 2018
(r338978)
+++ releng/11.2/sys/kern/vfs_syscalls.c Thu Sep 27 18:32:14 2018
(r338979)
@@ -600,6 +600,8 @@ freebsd4_getfsstat(struct thread *td, struct freebsd4_
size = count * sizeof(struct statfs);
error = kern_getfsstat(td, &buf, size, &count, UIO_SYSSPACE,
uap->mode);
+ if (buf == NULL)
+ return (EINVAL);
td->td_retval[0] = count;
if (size != 0) {
sp = buf;
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
