diff options
| author | Colin Percival <cperciva@FreeBSD.org> | 2005-05-06 02:40:49 +0000 |
|---|---|---|
| committer | Colin Percival <cperciva@FreeBSD.org> | 2005-05-06 02:40:49 +0000 |
| commit | be5dc24f940e3f8b04dd758f1c70db59db620d13 (patch) | |
| tree | 03f58203d6b54c07dc1b3f766cec59e592666665 | |
| parent | 00e16d3fa95a0440bd142767fde0dadef7b1e496 (diff) | |
Correctly validate inputs to the i386_get_ldt syscall.
Security: FreeBSD-SA-05:07.ldt
Approved by: re (kensmith)
Notes
svn path=/releng/5.4/; revision=145952
| -rw-r--r-- | UPDATING | 3 | ||||
| -rw-r--r-- | sys/i386/i386/sys_machdep.c | 9 |
2 files changed, 7 insertions, 5 deletions
@@ -8,6 +8,9 @@ Items affecting the ports and packages system can be found in /usr/ports/UPDATING. Please read that file before running portupgrade. Important recent entries: 20040724 (default X changes). +20050506: FreeBSD-SA-05:07.ldt + Correctly validate inputs to the i386_get_ldt syscall. + 20050506: FreeBSD-SA-05:06.iir Correct overly liberal permissions on /dev/iir. diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c index cc317980573e..5d9addad10c4 100644 --- a/sys/i386/i386/sys_machdep.c +++ b/sys/i386/i386/sys_machdep.c @@ -382,10 +382,6 @@ i386_get_ldt(td, args) uap->start, uap->num, (void *)uap->descs); #endif - /* verify range of LDTs exist */ - if ((uap->start < 0) || (uap->num <= 0)) - return(EINVAL); - if (pldt) { nldt = pldt->ldt_len; num = min(uap->num, nldt); @@ -395,7 +391,10 @@ i386_get_ldt(td, args) num = min(uap->num, nldt); lp = &ldt[uap->start]; } - if (uap->start + num > nldt) + + if ((uap->start > (unsigned int)nldt) || + ((unsigned int)num > (unsigned int)nldt) || + ((unsigned int)(uap->start + num) > (unsigned int)nldt)) return(EINVAL); error = copyout(lp, uap->descs, num * sizeof(union descriptor)); |