diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2001-01-19 18:31:31 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2001-01-19 18:31:31 +0000 |
| commit | d6d9b7e7c7d0c89ebbcc6d2b403b3cbd4e90f6c2 (patch) | |
| tree | 833bbdb482cf5d2d8acb14819393eb73cd12eff3 /sys/arch | |
| parent | a30b84ab63e3939eb1a697b8ac3a52242c23743b (diff) | |
validate gate targets; sommerfeld, mycroft
Diffstat (limited to 'sys/arch')
| -rw-r--r-- | sys/arch/i386/i386/sys_machdep.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/sys/arch/i386/i386/sys_machdep.c b/sys/arch/i386/i386/sys_machdep.c index b4bba0601c2..b1fb6877cfc 100644 --- a/sys/arch/i386/i386/sys_machdep.c +++ b/sys/arch/i386/i386/sys_machdep.c @@ -240,6 +240,17 @@ i386_set_ldt(p, args, retval) break; case SDT_SYS286CGT: case SDT_SYS386CGT: + /* + * Only allow call gates targeting a segment + * in the LDT or a user segment in the fixed + * part of the gdt. Segments in the LDT are + * constrained (below) to be user segments. + */ + if (desc.gd.gd_p != 0 && !ISLDT(desc.gd.gd_selector) && + ((IDXSEL(desc.gd.gd_selector) >= NGDT) || + (gdt[IDXSEL(desc.gd.gd_selector)].sd.sd_dpl != + SEL_UPL))) + return (EACCES); /* Can't replace in use descriptor with gate. */ if (n == fsslot || n == gsslot) return (EBUSY); |