[Bug 207629] Integer overflow in sysctl_kern_proc_args

From: <bugzilla-noreply_at_freebsd.org>
Date: Tue, 23 May 2023 20:26:15 UTC

Mark Johnston <markj@FreeBSD.org> changed:

           What    |Removed                     |Added
         Resolution|---                         |FIXED
                 CC|                            |markj@FreeBSD.org
             Status|New                         |Closed

--- Comment #2 from Mark Johnston <markj@FreeBSD.org> ---
Sorry that this didn't get attention when it was submitted.  I think this has
since been fixed by commit 712dda7fb0b83, though it's possible that something
else mitigated it before that.

> There is another possibility though; if `req->newlen` is `-12`, the allocation will be 0, and the 2 writes in `pargs_alloc` will be out of bounds.

An allocation length of zero will return a chunk of 16 bytes, so I don't think
this could have resulted in an out-of-bounds write.

You are receiving this mail because:
You are the assignee for the bug.