Author: jhb Date: Wed Feb 18 23:34:03 2015 New Revision: 278976 URL: https://svnweb.freebsd.org/changeset/base/278976
Log: Ensure that the supplied data length is large enough to hold the base FPU state to avoid passing a negative length to fpusetregs() / npxsetregs(). Differential Revision: https://reviews.freebsd.org/D1861 Reviewed by: kib, emaste Modified: head/sys/amd64/amd64/ptrace_machdep.c head/sys/i386/i386/ptrace_machdep.c Modified: head/sys/amd64/amd64/ptrace_machdep.c ============================================================================== --- head/sys/amd64/amd64/ptrace_machdep.c Wed Feb 18 23:10:15 2015 (r278975) +++ head/sys/amd64/amd64/ptrace_machdep.c Wed Feb 18 23:34:03 2015 (r278976) @@ -88,7 +88,8 @@ cpu_ptrace_xstate(struct thread *td, int break; case PT_SETXSTATE: - if (data > cpu_max_ext_state_size) { + if (data < sizeof(struct savefpu) || + data > cpu_max_ext_state_size) { error = EINVAL; break; } Modified: head/sys/i386/i386/ptrace_machdep.c ============================================================================== --- head/sys/i386/i386/ptrace_machdep.c Wed Feb 18 23:10:15 2015 (r278975) +++ head/sys/i386/i386/ptrace_machdep.c Wed Feb 18 23:34:03 2015 (r278976) @@ -92,7 +92,8 @@ cpu_ptrace_xstate(struct thread *td, int break; case PT_SETXSTATE: - if (data > cpu_max_ext_state_size) { + if (data < sizeof(union savefpu) || + data > cpu_max_ext_state_size) { error = EINVAL; break; } _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "[email protected]"
