careful strlcpy and snprintf return handling; ok pedro beck

2 files changed, 15 insertions, 6 deletions

diff --git a/sys/miscfs/procfs/procfs_linux.c b/sys/miscfs/procfs/procfs_linux.c
index 356a173d8aa..d3caeb8ae83 100644
--- a/sys/miscfs/procfs/procfs_linux.c
+++ b/sys/miscfs/procfs/procfs_linux.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_linux.c,v 1.5 2004/05/05 23:52:10 tedu Exp $	*/
+/*	$OpenBSD: procfs_linux.c,v 1.6 2005/04/21 23:28:55 deraadt Exp $	*/
 /*      $NetBSD: procfs_linux.c,v 1.2.4.1 2001/03/30 21:48:11 he Exp $      */
 
 /*
@@ -89,8 +89,9 @@ procfs_domeminfo(struct proc *curp, struct proc *p, struct pfsnode *pfs,
 		PGTOKB(uvmexp.swpages),
 		PGTOKB(uvmexp.swpages - uvmexp.swpginuse));
 
-	if (len == 0 || len <= uio->uio_offset || uio->uio_resid == 0)
-		return 0;
+	if (len <= 0 || len >= sizeof buf ||
+	    len <= uio->uio_offset || uio->uio_resid == 0)
+		return EINVAL;
 
 	len -= uio->uio_offset;
 	cp = buf + uio->uio_offset;
diff --git a/sys/miscfs/procfs/procfs_vnops.c b/sys/miscfs/procfs/procfs_vnops.c
index a9125261db2..244a0012feb 100644
--- a/sys/miscfs/procfs/procfs_vnops.c
+++ b/sys/miscfs/procfs/procfs_vnops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: procfs_vnops.c,v 1.35 2005/04/16 22:19:28 kettenis Exp $	*/
+/*	$OpenBSD: procfs_vnops.c,v 1.36 2005/04/21 23:28:55 deraadt Exp $	*/
 /*	$NetBSD: procfs_vnops.c,v 1.40 1996/03/16 23:52:55 christos Exp $	*/
 
 /*
@@ -602,11 +602,17 @@ procfs_getattr(v)
 
 	case Pcurproc: {
 		char buf[16];		/* should be enough */
+		int len;
+
+		len = snprintf(buf, sizeof buf, "%ld", (long)curproc->p_pid);
+		if (len == -1 || len >= sizeof buf) {
+			error = EINVAL;
+			break;
+		}
 		vap->va_nlink = 1;
 		vap->va_uid = 0;
 		vap->va_gid = 0;
-		vap->va_size = vap->va_bytes =
-		    snprintf(buf, sizeof buf, "%ld", (long)curproc->p_pid);
+		vap->va_size = vap->va_bytes = len;
 		break;
 	}
 
@@ -1092,6 +1098,8 @@ procfs_readlink(v)
 		len = strlcpy(buf, "curproc", sizeof buf);
 	else
 		return (EINVAL);
+	if (len == -1 || len >= sizeof buf)
+		return (EINVAL);
 
 	return (uiomove(buf, len, ap->a_uio));
 }