[src/netbsd-2]: src/sys/miscfs/kernfs Pull up following revision(s) (requeste...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/60f1919c007f
branches:  netbsd-2
changeset: 564025:60f1919c007f
user:      tron <tron%NetBSD.org@localhost>
date:      Wed Aug 31 13:27:01 2005 +0000

description:
Pull up following revision(s) (requested by christos in ticket #5633):
        sys/miscfs/kernfs/kernfs_vnops.c: revision 1.111
Don't allow negative offsets when reading the message buffer, because it
can allow reading arbitrary kernel memory.

diffstat:

 sys/miscfs/kernfs/kernfs_vnops.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 091d0d9405de -r 60f1919c007f sys/miscfs/kernfs/kernfs_vnops.c
--- a/sys/miscfs/kernfs/kernfs_vnops.c  Wed Aug 31 06:03:29 2005 +0000
+++ b/sys/miscfs/kernfs/kernfs_vnops.c  Wed Aug 31 13:27:01 2005 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kernfs_vnops.c,v 1.98.2.3.2.1 2005/05/24 19:50:34 riz Exp $    */
+/*     $NetBSD: kernfs_vnops.c,v 1.98.2.3.2.2 2005/08/31 13:27:01 tron Exp $   */
 
 /*
  * Copyright (c) 1992, 1993
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kernfs_vnops.c,v 1.98.2.3.2.1 2005/05/24 19:50:34 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kernfs_vnops.c,v 1.98.2.3.2.2 2005/08/31 13:27:01 tron Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -426,6 +426,10 @@
                 * message buffer header are corrupted, but that'll cause
                 * the system to die anyway.
                 */
+               if (off < 0) {
+                       *wrlen = 0;
+                       return EINVAL;
+               }
                if (off >= msgbufp->msg_bufs) {
                        *wrlen = 0;
                        return (0);