cvs commit: src/sys/kern kern_environment.c
ariff at FreeBSD.org
Mon Jan 30 04:17:30 PST 2006
ariff 2006-01-30 12:17:29 UTC
FreeBSD src repository
Modified files: (Branch: RELENG_5)
Add bounds checking to the setenv part of the kernel environment.
This has no security implications since only root is allowed to use
kenv(1) (and corrupt the kernel memory after adding too much variables
previous to this commit).
This is based upon the PR  mentioned below, but extended to check both
bounds (in case of an overflow of the counting variable) and to comply
to the style of the function. An overflow of the counting variable
shouldn't happen after adding the check for the upper bound, but better
safe than sorry (in case some other function in the kernel overwrites
An interested soul may want to add a printf to notify root in case the
bounds are hit.
Also allocate KENV_SIZE+1 entries (the array is NULL-terminated), since
the comment for KENV_SIZE says it's the maximum number of environment
Reorder statements to avoid accessing unknown memory.
In theory, invoking kenv with very long string can panic
PR: 83687 
Submitted by: Harry Coin <harrycoin at qconline.com> 
Revision Changes Path
18.104.22.168 +10 -3 src/sys/kern/kern_environment.c
More information about the cvs-src