FreeBSD Kernel buffer overflow

[gerarra at tin.it]

>==============================
>
>> cat kern_syscalls.diff
>--- kern_syscalls.c     Sat Sep 18 14:37:53 2004
>+++ kern_syscalls2.c    Sat Sep 18 14:37:53 2004
>@@ -73,6 +73,11 @@
>                                sysent[*offset].sy_call != (sy_call_t *)lkmressys)
>                return EEXIST;
>
>+#if (__i386__) && (INVARIANTS)
>+       KASSERT(new_sysent->nargs >= 0 && new_sysent->nargs <= i386_SYS_ARGS,
>+               "invalid number of syscalls");
>+#endif
>+
>        *old_sysent = sysent[*offset];
>        sysent[*offset] = *new_sysent;
>        return 0;

Sorry, a little problem here. There correct text chunk:


> cat kern_syscalls.diff
--- kern_syscalls.c     Sat Sep 18 14:37:53 2004
+++ kern_syscalls2.c    Sat Sep 18 14:37:53 2004
@@ -73,6 +73,11 @@
                                sysent[*offset].sy_call != (sy_call_t *)lkmressys)
                return EEXIST;

+#if (__i386__) && (INVARIANTS)
+       KASSERT(new_sysent->sy_nargs >= 0 && new_sysent->sy_nargs <= i386_SYS_ARGS,
+               "invalid number of syscalls");
+#endif
+
        *old_sysent = sysent[*offset];
        sysent[*offset] = *new_sysent;
        return 0;

(tgz is correct)

rookie