Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/netbsd-7]: src/sys/kern Pull up following revision(s) (requested by maxv...



details:   https://anonhg.NetBSD.org/src/rev/12d409e0c0e1
branches:  netbsd-7
changeset: 800579:12d409e0c0e1
user:      martin <martin%NetBSD.org@localhost>
date:      Wed Nov 28 19:39:56 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #1658):

        sys/kern/kern_exec.c: revision 1.462

Fix stack info leak. There are 2x4 bytes of padding in struct ps_strings.

[  223.896199] kleak: Possible leak in copyout: [len=32, leaked=8]
[  223.906430] #0 0xffffffff80224d0a in kleak_note <netbsd>
[  223.906430] #1 0xffffffff80224d8a in kleak_copyout <netbsd>
[  223.918363] #2 0xffffffff80b1e26c in copyoutpsstrs <netbsd>
[  223.926560] #3 0xffffffff80b1e331 in copyoutargs <netbsd>
[  223.936216] #4 0xffffffff80b21768 in execve_runproc <netbsd>
[  223.946225] #5 0xffffffff80b21cc9 in execve1 <netbsd>
[  223.946225] #6 0xffffffff8025a89c in sy_call <netbsd>
[  223.956225] #7 0xffffffff8025aace in sy_invoke <netbsd>
[  223.966232] #8 0xffffffff8025ab54 in syscall <netbsd>

diffstat:

 sys/kern/kern_exec.c |  6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diffs (27 lines):

diff -r 2b5a2af0d052 -r 12d409e0c0e1 sys/kern/kern_exec.c
--- a/sys/kern/kern_exec.c      Wed Nov 28 16:30:37 2018 +0000
+++ b/sys/kern/kern_exec.c      Wed Nov 28 19:39:56 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_exec.c,v 1.408.2.5 2018/02/25 21:16:07 snj Exp $  */
+/*     $NetBSD: kern_exec.c,v 1.408.2.6 2018/11/28 19:39:56 martin Exp $       */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -59,7 +59,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.408.2.5 2018/02/25 21:16:07 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.408.2.6 2018/11/28 19:39:56 martin Exp $");
 
 #include "opt_exec.h"
 #include "opt_execfmt.h"
@@ -1391,6 +1391,8 @@
        struct proc             *p = l->l_proc;
        int                     error;
 
+       memset(&data->ed_arginfo, 0, sizeof(data->ed_arginfo));
+
        /* remember information about the process */
        data->ed_arginfo.ps_nargvstr = data->ed_argc;
        data->ed_arginfo.ps_nenvstr = data->ed_envc;



Home | Main Index | Thread Index | Old Index