[src/netbsd-3-0]: src/sys Pull up following revision(s) (requested by christo...

[ghen <ghen%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7589c9e6ae1c
branches:  netbsd-3-0
changeset: 579305:7589c9e6ae1c
user:      ghen <ghen%NetBSD.org@localhost>
date:      Mon Oct 16 20:36:57 2006 +0000

description:
Pull up following revision(s) (requested by christos in ticket #1544):
        sys/sys/systrace.h: revision 1.21
        sys/kern/kern_systrace.c: revision 1.59
Fix an exploitable integer overflow found by Chris Evans of Google Security.

diffstat:

 sys/kern/kern_systrace.c |  19 +++++++++++++++----
 sys/sys/systrace.h       |   3 ++-
 2 files changed, 17 insertions(+), 5 deletions(-)

diffs (73 lines):

diff -r 81fe5f197b97 -r 7589c9e6ae1c sys/kern/kern_systrace.c
--- a/sys/kern/kern_systrace.c  Thu Oct 12 09:50:19 2006 +0000
+++ b/sys/kern/kern_systrace.c  Mon Oct 16 20:36:57 2006 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_systrace.c,v 1.44.2.2.2.1 2005/12/29 20:25:29 riz Exp $   */
+/*     $NetBSD: kern_systrace.c,v 1.44.2.2.2.2 2006/10/16 20:36:57 ghen Exp $  */
 
 /*
  * Copyright 2002, 2003 Niels Provos <provos%citi.umich.edu@localhost>
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_systrace.c,v 1.44.2.2.2.1 2005/12/29 20:25:29 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_systrace.c,v 1.44.2.2.2.2 2006/10/16 20:36:57 ghen Exp $");
 
 #include "opt_systrace.h"
 
@@ -1260,9 +1260,16 @@
                return (EINVAL);
 
        for (i = 0, len = 0; i < repl->strr_nrepl; i++) {
-               len += repl->strr_offlen[i];
+               if (repl->strr_argind[i] < 0 ||
+                   repl->strr_argind[i] >= SYSTR_MAXARGS)
+                       return (EINVAL);
                if (repl->strr_offlen[i] == 0)
                        continue;
+               len += repl->strr_offlen[i];
+               if (repl->strr_offlen[i] > SYSTR_MAXREPLEN ||
+                   repl->strr_off[i] > SYSTR_MAXREPLEN ||
+                   len > SYSTR_MAXREPLEN)
+                       return (EINVAL);
                if (repl->strr_offlen[i] + repl->strr_off[i] > len)
                        return (EINVAL);
        }
@@ -1272,7 +1279,7 @@
                return (EINVAL);
 
        /* Check against a maximum length */
-       if (repl->strr_len > 2048)
+       if (repl->strr_len > SYSTR_MAXREPLEN)
                return (EINVAL);
 
        strp->replace = (struct systrace_replace *)
@@ -1313,6 +1320,10 @@
        sg = stackgap_init(p->p_emul);
        ubase = stackgap_alloc(&sg, repl->strr_len);
 #endif
+       if (ubase == NULL) {
+               ret = EINVAL;
+               goto out;
+       }
 
        kbase = repl->strr_base;
        for (i = 0; i < maxarg && i < repl->strr_nrepl; i++) {
diff -r 81fe5f197b97 -r 7589c9e6ae1c sys/sys/systrace.h
--- a/sys/sys/systrace.h        Thu Oct 12 09:50:19 2006 +0000
+++ b/sys/sys/systrace.h        Mon Oct 16 20:36:57 2006 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: systrace.h,v 1.12.14.2 2005/07/02 18:50:06 tron Exp $  */
+/*     $NetBSD: systrace.h,v 1.12.14.2.2.1 2006/10/16 20:36:57 ghen Exp $      */
 
 /*
  * Copyright 2002 Niels Provos <provos%citi.umich.edu@localhost>
@@ -51,6 +51,7 @@
 #define SYSTR_MAX_POLICIES     64
 #define SYSTR_MAXARGS          64
 #define SYSTR_MAXFNAME         8
+#define SYSTR_MAXREPLEN                2048
 
 struct str_msg_ask {
        int32_t code;