diff options
| author | Philip Guenthe <guenther@cvs.openbsd.org> | 2010-06-29 16:39:24 +0000 |
|---|---|---|
| committer | Philip Guenthe <guenther@cvs.openbsd.org> | 2010-06-29 16:39:24 +0000 |
| commit | 7e2ce9013f05c75e01cb40373c07987f0ef38c18 (patch) | |
| tree | 8e34ccfaba6ca7f0da217e7b885f3d9863b3b73c /sys/kern/kern_sysctl.c | |
| parent | 1ed6e9cfcea3a61394a15bffa818853ef153e52b (diff) | |
Fail instead of lying if a process asks sysctl()'s KERN_PROC2 or
KERN_FILE2 (or their libkvm wrappers) for more information than the
running implementation knows how to provide.
ok millert@ deraadt@
Diffstat (limited to 'sys/kern/kern_sysctl.c')
| -rw-r--r-- | sys/kern/kern_sysctl.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c index 125e8334668..401280e5101 100644 --- a/sys/kern/kern_sysctl.c +++ b/sys/kern/kern_sysctl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_sysctl.c,v 1.185 2010/06/29 00:28:14 tedu Exp $ */ +/* $OpenBSD: kern_sysctl.c,v 1.186 2010/06/29 16:39:22 guenther Exp $ */ /* $NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $ */ /*- @@ -1198,7 +1198,7 @@ sysctl_file2(int *name, u_int namelen, char *where, size_t *sizep, if (namelen > 4) return (ENOTDIR); - if (namelen < 4) + if (namelen < 4 || name[2] > sizeof(*kf)) return (EINVAL); buflen = where != NULL ? *sizep : 0; @@ -1352,7 +1352,8 @@ sysctl_doproc(int *name, u_int namelen, char *where, size_t *sizep) elem_size = elem_count = 0; eproc = malloc(sizeof(struct eproc), M_TEMP, M_WAITOK); } else /* if (type == KERN_PROC2) */ { - if (namelen != 5 || name[3] < 0 || name[4] < 0) + if (namelen != 5 || name[3] < 0 || name[4] < 0 || + name[3] > sizeof(*kproc2)) return (EINVAL); op = name[1]; arg = name[2]; |