diff options
| author | Christos Margiolis <christos@FreeBSD.org> | 2024-05-20 14:18:28 +0000 |
|---|---|---|
| committer | Christos Margiolis <christos@FreeBSD.org> | 2024-05-21 17:45:49 +0000 |
| commit | 5830a00c2c5485ec17900558e4f29c459c6a1f3e (patch) | |
| tree | 07964ea1e7d49bb750c8368faf6df74c8f09d8fb | |
| parent | bca6f391aed9ecc01d6b7f496ddb6a17311e4c2c (diff) | |
sound: Check user-supplied size passed to SNDSTIOC_ADD_USER_DEVS*
SNDSTIOC_ADD_USER_DEVS* expects a user-supplied sndstioc_nv_arg->nbytes,
however we currently do not check whether this size is actually valid,
which results in a panic when SNDSTIOC_ADD_USER_DEVS* is called with an
invalid size. sndstat_add_user_devs() calls
sndstat_unpack_user_nvlbuf(), which then calls malloc() with that size.
PR: 266142
Sponsored by: The FreeBSD Foundation
MFC after: 1 day
Reviewed by: brooks
Differential Revision: https://reviews.freebsd.org/D45236
(cherry picked from commit 074d337ad618f9cc2a1d5ab18b484928e57bd72b)
| -rw-r--r-- | sys/dev/sound/pcm/sndstat.c | 5 | ||||
| -rw-r--r-- | sys/sys/sndstat.h | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/sys/dev/sound/pcm/sndstat.c b/sys/dev/sound/pcm/sndstat.c index edb33e92ade9..f310d8f3bff3 100644 --- a/sys/dev/sound/pcm/sndstat.c +++ b/sys/dev/sound/pcm/sndstat.c @@ -864,6 +864,11 @@ sndstat_add_user_devs(struct sndstat_file *pf, caddr_t data) goto done; } + if (arg->nbytes > SNDST_UNVLBUF_MAX) { + err = ENOMEM; + goto done; + } + err = sndstat_unpack_user_nvlbuf(arg->buf, arg->nbytes, &nvl); if (err != 0) goto done; diff --git a/sys/sys/sndstat.h b/sys/sys/sndstat.h index f0e4d352242f..8a49042b0453 100644 --- a/sys/sys/sndstat.h +++ b/sys/sys/sndstat.h @@ -74,6 +74,11 @@ struct sndstioc_nv_arg { #define SNDST_DSPS_SOUND4_PVCHAN "pvchan" #define SNDST_DSPS_SOUND4_RVCHAN "rvchan" +/* + * Maximum user-specified nvlist buffer size + */ +#define SNDST_UNVLBUF_MAX 65535 + #define SNDSTIOC_REFRESH_DEVS \ _IO('D', 100) #define SNDSTIOC_GET_DEVS \ |