diff options
| author | Gordon Tetlow <gordon@FreeBSD.org> | 2020-01-28 18:54:15 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2020-01-28 18:54:15 +0000 |
| commit | 48ba6a8ea7acf6cc9e77f63ab573846333035c97 (patch) | |
| tree | ca04ee32e46921079a7cb204d0a6ded1d03ba3a0 | |
| parent | d393ae5f4730e86dad86dc2b24cd43db796d426a (diff) | |
| download | src-48ba6a8ea7acf6cc9e77f63ab573846333035c97.tar.gz src-48ba6a8ea7acf6cc9e77f63ab573846333035c97.zip | |
Fix nmount invalid pointer dereference
Submitted by: Andrew Turner
Approved by: so
Security: FreeBSD-EN-20:02.nmount
Notes
Notes:
svn path=/releng/11.3/; revision=357216
| -rw-r--r-- | sys/kern/vfs_mount.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index e841e8a40aca..c176faf886ab 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -591,7 +591,7 @@ vfs_donmount(struct thread *td, uint64_t fsflags, struct uio *fsoptions) */ fstypelen = 0; error = vfs_getopt(optlist, "fstype", (void **)&fstype, &fstypelen); - if (error || fstype[fstypelen - 1] != '\0') { + if (error || fstypelen <= 0 || fstype[fstypelen - 1] != '\0') { error = EINVAL; if (errmsg != NULL) strncpy(errmsg, "Invalid fstype", errmsg_len); @@ -599,7 +599,7 @@ vfs_donmount(struct thread *td, uint64_t fsflags, struct uio *fsoptions) } fspathlen = 0; error = vfs_getopt(optlist, "fspath", (void **)&fspath, &fspathlen); - if (error || fspath[fspathlen - 1] != '\0') { + if (error || fspathlen <= 0 || fspath[fspathlen - 1] != '\0') { error = EINVAL; if (errmsg != NULL) strncpy(errmsg, "Invalid fspath", errmsg_len); |