CVS commit: [netbsd-5-0] src/sys/kern

[Soren Jacobsen <snj%netbsd.org@localhost>]

Module Name:    src
Committed By:   snj
Date:           Fri Dec 18 05:27:56 UTC 2009

Modified Files:
        src/sys/kern [netbsd-5-0]: sys_mqueue.c

Log Message:
Pull up following revision(s) (requested by tron in ticket #1188):
        sys/kern/sys_mqueue.c: revision 1.28 via patch
fix some security critical bugs:
-an invalid signal number passed to mq_notify(2) could crash the kernel
on delivery -- add a boundary check
-a user could set mq_maxmsg (the maximal number of messages in a queue)
to a huge value on mq_open(O_CREAT) and later use up all kernel
memory by mq_send(2) -- add a sysctl'able limit which defaults
to 16*mq_def_maxmsg
(mq_notify(2) should get some more checks, and SIGEV_* values other
than SIGEV_SIGNAL should be handled somehow, but this doesn't look
security critical)


To generate a diff of this commit:
cvs rdiff -u -r1.12.4.1.2.3 -r1.12.4.1.2.4 src/sys/kern/sys_mqueue.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.