diff options
author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2005-04-21 23:29:05 +0000 |
---|---|---|
committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2005-04-21 23:29:05 +0000 |
commit | 1b4aea96a7e3631bc61ad0d2ce06bde6bb77b955 (patch) | |
tree | 8e358500052f0c128037f5a3dc73836af0422ebd /sys/miscfs/procfs | |
parent | f1edfddc3c03c1ed513c9350894fdcae38afa334 (diff) |
careful strlcpy and snprintf return handling; ok pedro beck
Diffstat (limited to 'sys/miscfs/procfs')
-rw-r--r-- | sys/miscfs/procfs/procfs_linux.c | 7 | ||||
-rw-r--r-- | sys/miscfs/procfs/procfs_vnops.c | 14 |
2 files changed, 15 insertions, 6 deletions
diff --git a/sys/miscfs/procfs/procfs_linux.c b/sys/miscfs/procfs/procfs_linux.c index 356a173d8aa..d3caeb8ae83 100644 --- a/sys/miscfs/procfs/procfs_linux.c +++ b/sys/miscfs/procfs/procfs_linux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: procfs_linux.c,v 1.5 2004/05/05 23:52:10 tedu Exp $ */ +/* $OpenBSD: procfs_linux.c,v 1.6 2005/04/21 23:28:55 deraadt Exp $ */ /* $NetBSD: procfs_linux.c,v 1.2.4.1 2001/03/30 21:48:11 he Exp $ */ /* @@ -89,8 +89,9 @@ procfs_domeminfo(struct proc *curp, struct proc *p, struct pfsnode *pfs, PGTOKB(uvmexp.swpages), PGTOKB(uvmexp.swpages - uvmexp.swpginuse)); - if (len == 0 || len <= uio->uio_offset || uio->uio_resid == 0) - return 0; + if (len <= 0 || len >= sizeof buf || + len <= uio->uio_offset || uio->uio_resid == 0) + return EINVAL; len -= uio->uio_offset; cp = buf + uio->uio_offset; diff --git a/sys/miscfs/procfs/procfs_vnops.c b/sys/miscfs/procfs/procfs_vnops.c index a9125261db2..244a0012feb 100644 --- a/sys/miscfs/procfs/procfs_vnops.c +++ b/sys/miscfs/procfs/procfs_vnops.c @@ -1,4 +1,4 @@ -/* $OpenBSD: procfs_vnops.c,v 1.35 2005/04/16 22:19:28 kettenis Exp $ */ +/* $OpenBSD: procfs_vnops.c,v 1.36 2005/04/21 23:28:55 deraadt Exp $ */ /* $NetBSD: procfs_vnops.c,v 1.40 1996/03/16 23:52:55 christos Exp $ */ /* @@ -602,11 +602,17 @@ procfs_getattr(v) case Pcurproc: { char buf[16]; /* should be enough */ + int len; + + len = snprintf(buf, sizeof buf, "%ld", (long)curproc->p_pid); + if (len == -1 || len >= sizeof buf) { + error = EINVAL; + break; + } vap->va_nlink = 1; vap->va_uid = 0; vap->va_gid = 0; - vap->va_size = vap->va_bytes = - snprintf(buf, sizeof buf, "%ld", (long)curproc->p_pid); + vap->va_size = vap->va_bytes = len; break; } @@ -1092,6 +1098,8 @@ procfs_readlink(v) len = strlcpy(buf, "curproc", sizeof buf); else return (EINVAL); + if (len == -1 || len >= sizeof buf) + return (EINVAL); return (uiomove(buf, len, ap->a_uio)); } |