[Bug 209661] amd64_set_ioperm overflow

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Fri May 20 17:53:53 UTC 2016


--- Comment #2 from CTurt <cturt at hardenedbsd.org> ---
Sorry, I made a mistake in my report; the bound check is incorrect, as
described, however, no negative array index will occur from this since an
unsigned comparison is used in the loop. The impact is simply that `0` will be
returned instead of `EINVAL`.

This patch is good because unsigned is more appropriate for `i`, however it
doesn't fix the bug.

An additional patch should be applied to validate user arguments more
effectively than the current bound check, so that the arguments I posted
originally will no longer be accepted.

You are receiving this mail because:
You are on the CC list for the bug.

More information about the freebsd-amd64 mailing list