svn commit: r237366 - head/sys/ufs/ffs

[Konstantin Belousov]

Author: kib
Date: Thu Jun 21 09:20:07 2012
New Revision: 237366
URL: http://svn.freebsd.org/changeset/base/237366

Log:
  Fix unbounded-length malloc, controlled from usermode. The added check
  is performed before exact size of the buffer is calculated, but the
  buffer cannot have size greater then the total space allocated for
  extended attributes. The existing check is executing with precise
  size, but it is too late, since buffer needs to be allocated in
  advance.
  
  Also, adapt to uio_resid being of ssize_t type.  Use lblktosize instead of
  multiplying by fs block size by hand as well.
  
  Reported and tested by:	  pho
  MFC after:   1 week

Modified:
  head/sys/ufs/ffs/ffs_vnops.c

Modified: head/sys/ufs/ffs/ffs_vnops.c
==============================================================================
--- head/sys/ufs/ffs/ffs_vnops.c	Thu Jun 21 09:19:41 2012	(r237365)
+++ head/sys/ufs/ffs/ffs_vnops.c	Thu Jun 21 09:20:07 2012	(r237366)
@@ -1648,7 +1648,8 @@ vop_setextattr {
 	struct inode *ip;
 	struct fs *fs;
 	uint32_t ealength, ul;
-	int ealen, olen, eapad1, eapad2, error, i, easize;
+	ssize_t ealen;
+	int olen, eapad1, eapad2, error, i, easize;
 	u_char *eae, *p;
 
 	ip = VTOI(ap->a_vp);
@@ -1667,6 +1668,10 @@ vop_setextattr {
 	if (ap->a_vp->v_mount->mnt_flag & MNT_RDONLY)
 		return (EROFS);
 
+	ealen = ap->a_uio->uio_resid;
+	if (ealen < 0 || ealen > lblktosize(fs, NXADDR))
+		return (EINVAL);
+
 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
 	    ap->a_cred, ap->a_td, VWRITE);
 	if (error) {
@@ -1684,7 +1689,6 @@ vop_setextattr {
 	if (error)
 		return (error);
 
-	ealen = ap->a_uio->uio_resid;
 	ealength = sizeof(uint32_t) + 3 + strlen(ap->a_name);
 	eapad1 = 8 - (ealength % 8);
 	if (eapad1 == 8)
@@ -1712,7 +1716,7 @@ vop_setextattr {
 			easize += (ealength - ul);
 		}
 	}
-	if (easize > NXADDR * fs->fs_bsize) {
+	if (easize > lblktosize(fs, NXADDR)) {
 		free(eae, M_TEMP);
 		ffs_close_ea(ap->a_vp, 0, ap->a_cred, ap->a_td);
 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)