[Bug 266142] SNDSTIOC_ADD_USER_DEVS ioctl on /dev/sndstat passes unchecked size from user to malloc() -> potential crash

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266142

--- Comment #5 from commit-hook@FreeBSD.org ---
A commit in branch releng/14.1 references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=18f80d6d463495703f9eb2ccfd92bae93c7889a3

commit 18f80d6d463495703f9eb2ccfd92bae93c7889a3
Author:     Christos Margiolis <christos@FreeBSD.org>
AuthorDate: 2024-05-20 14:18:28 +0000
Commit:     Christos Margiolis <christos@FreeBSD.org>
CommitDate: 2024-05-22 13:22:26 +0000

    sound: Check user-supplied size passed to SNDSTIOC_ADD_USER_DEVS*

    SNDSTIOC_ADD_USER_DEVS* expects a user-supplied sndstioc_nv_arg->nbytes,
    however we currently do not check whether this size is actually valid,
    which results in a panic when SNDSTIOC_ADD_USER_DEVS* is called with an
    invalid size. sndstat_add_user_devs() calls
    sndstat_unpack_user_nvlbuf(), which then calls malloc() with that size.

    PR:             266142
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 day
    Reviewed by:    brooks
    Differential Revision:  https://reviews.freebsd.org/D45236

    (cherry picked from commit 074d337ad618f9cc2a1d5ab18b484928e57bd72b)
    (cherry picked from commit 5830a00c2c5485ec17900558e4f29c459c6a1f3e)

    Approved by:    re (cperciva)

 sys/dev/sound/pcm/sndstat.c | 5 +++++
 sys/sys/sndstat.h           | 5 +++++
 2 files changed, 10 insertions(+)

-- 
You are receiving this mail because:
You are the assignee for the bug.