[src/netbsd-1-6]: src/sys/kern Pull up revision 1.147 (requested by itojun in...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/70ff0e7d0cae
branches:  netbsd-1-6
changeset: 530762:70ff0e7d0cae
user:      tron <tron%NetBSD.org@localhost>
date:      Thu Oct 02 08:59:10 2003 +0000

description:
Pull up revision 1.147 (requested by itojun in ticket #1493):
make debug_sysctl() sysctl MIB check more strict. from smak.
attack similar to NetBSD-SA2003-014 can be mounted due to this flaw.

diffstat:

 sys/kern/kern_sysctl.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r 251af9717f9c -r 70ff0e7d0cae sys/kern/kern_sysctl.c
--- a/sys/kern/kern_sysctl.c    Wed Oct 01 15:05:55 2003 +0000
+++ b/sys/kern/kern_sysctl.c    Thu Oct 02 08:59:10 2003 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_sysctl.c,v 1.108.4.3 2003/08/27 08:01:48 tron Exp $       */
+/*     $NetBSD: kern_sysctl.c,v 1.108.4.4 2003/10/02 08:59:10 tron Exp $       */
 
 /*-
  * Copyright (c) 1982, 1986, 1989, 1993
@@ -43,7 +43,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.108.4.3 2003/08/27 08:01:48 tron Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.108.4.4 2003/10/02 08:59:10 tron Exp $");
 
 #include "opt_ddb.h"
 #include "opt_insecure.h"
@@ -657,7 +657,7 @@
        /* all sysctl names at this level are name and field */
        if (namelen != 2)
                return (ENOTDIR);               /* overloaded */
-       if (name[0] >= CTL_DEBUG_MAXID)
+       if (name[0] < 0 || name[0] >= CTL_DEBUG_MAXID)
                return (EOPNOTSUPP);
        cdp = debugvars[name[0]];
        if (cdp->debugname == 0)