[Bug 264468] libc: fix possible integer underflow

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264468

Mark Johnston <markj@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|New                         |Open
                 CC|                            |markj@FreeBSD.org

--- Comment #1 from Mark Johnston <markj@FreeBSD.org> ---
In all three cases, orig_buf_size and buffer_size are unsigned.  So in the
comparison "orig_buf_size < buffer_size - sizeof(struct protoent) - sizeof(char
*)", if underflow occurs, the right-hand side will wrap around to a large value
and the comparison will evaluate to true, causing __proto_unmarshal_func() to
return an error.  Also note that "buffer_size" is directly set by the caller,
the generic NSS cache code starts the buffer size at
NSS_CACHE_BUFFER_INITIAL_SIZE (1KB) and grows it.  So, I don't quite see the
problem here - can you explain further?

BTW, the attached patch does not seem to compile.

-- 
You are receiving this mail because:
You are the assignee for the bug.