diff options
| author | Konstantin Belousov <kib@FreeBSD.org> | 2022-06-03 08:21:23 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2022-08-09 19:44:45 +0000 |
| commit | 00d17cf342cd9f4f8fd1dcd79c8caec359145532 (patch) | |
| tree | 8dd4f35013e04cb9556df1921eb8748a69b8d8a5 | |
| parent | 6b6367ba8fd2b29de29ce08e7432291e807c3bc0 (diff) | |
elf_note_prpsinfo: handle more failures from proc_getargv()
Resulting sbuf_len() from proc_getargv() might return 0 if user mangled
ps_strings enough. Also, sbuf_len() API contract is to return -1 if the
buffer overflowed. The later should not occur because get_ps_strings()
checks for catenated length, but check for this subtle detail explicitly
as well to be more resilent.
The end result is that p_comm is used in this situations.
Approved by: so
Security: FreeBSD-SA-22:09.elf
Reported by: Josef 'Jeff' Sipek <jeffpc@josefsipek.net>
Reviewed by: delphij, markj
admbugs: 988
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D35391
| -rw-r--r-- | sys/compat/linux/linux_elf.c | 9 | ||||
| -rw-r--r-- | sys/kern/imgact_elf.c | 11 |
2 files changed, 13 insertions, 7 deletions
diff --git a/sys/compat/linux/linux_elf.c b/sys/compat/linux/linux_elf.c index bcbd4d1cad51..b02b6e2cc777 100644 --- a/sys/compat/linux/linux_elf.c +++ b/sys/compat/linux/linux_elf.c @@ -155,13 +155,16 @@ __linuxN(note_prpsinfo)(void *arg, struct sbuf *sb, size_t *sizep) sizeof(psinfo->pr_psargs), SBUF_FIXEDLEN); error = proc_getargv(curthread, p, &sbarg); PRELE(p); - if (sbuf_finish(&sbarg) == 0) + if (sbuf_finish(&sbarg) == 0) { len = sbuf_len(&sbarg) - 1; - else + if (len > 0) + len--; + } else { len = sizeof(psinfo->pr_psargs) - 1; + } sbuf_delete(&sbarg); } - if (error || len == 0) + if (error != 0 || len == 0 || (ssize_t)len == -1) strlcpy(psinfo->pr_psargs, p->p_comm, sizeof(psinfo->pr_psargs)); else { diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index ca4c59089775..38be7d100ae9 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -2205,13 +2205,16 @@ __elfN(note_prpsinfo)(void *arg, struct sbuf *sb, size_t *sizep) sizeof(psinfo->pr_psargs), SBUF_FIXEDLEN); error = proc_getargv(curthread, p, &sbarg); PRELE(p); - if (sbuf_finish(&sbarg) == 0) - len = sbuf_len(&sbarg) - 1; - else + if (sbuf_finish(&sbarg) == 0) { + len = sbuf_len(&sbarg); + if (len > 0) + len--; + } else { len = sizeof(psinfo->pr_psargs) - 1; + } sbuf_delete(&sbarg); } - if (error || len == 0) + if (error != 0 || len == 0 || (ssize_t)len == -1) strlcpy(psinfo->pr_psargs, p->p_comm, sizeof(psinfo->pr_psargs)); else { |