[src/trunk]: src/sys/compat/ibcs2 Make sure we have enough space in the buffe...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4c5bf1b53212
branches:  trunk
changeset: 355404:4c5bf1b53212
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Fri Jul 28 15:50:04 2017 +0000

description:
Make sure we have enough space in the buffer before reading it.

>From Ilja Van Sprundel.

diffstat:

 sys/compat/ibcs2/ibcs2_exec_coff.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r db80bdc99798 -r 4c5bf1b53212 sys/compat/ibcs2/ibcs2_exec_coff.c
--- a/sys/compat/ibcs2/ibcs2_exec_coff.c        Fri Jul 28 15:47:23 2017 +0000
+++ b/sys/compat/ibcs2/ibcs2_exec_coff.c        Fri Jul 28 15:50:04 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $   */
+/*     $NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $   */
 
 /*
  * Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.27 2017/07/28 15:47:23 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -454,6 +454,10 @@
                }
                bufp = tbuf;
                while (len) {
+                       if (len < sizeof(struct coff_slhdr)) {
+                               free(tbuf, M_TEMP);
+                               return ENOEXEC;
+                       }
                        slhdr = (struct coff_slhdr *)bufp;
 
                        if (slhdr->path_index > LONG_MAX / sizeof(long) ||