[Bug 206581] bxe_ioctl_nvram handler is faulty

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Fri Jan 29 22:39:31 UTC 2016


--- Comment #3 from CTurt <cturt at hardenedbsd.org> ---
To clarify my original post, the bound check is fine.

However, there is a problem that multiple parts of this code use `copyin`
without checking the result, which could possibly lead to the use of
uninitialised stack data if the `copyin` calls fail.


    copyin(ifr->ifr_data, &nvdata_base, sizeof(nvdata_base));


        copyin(ifr->ifr_data, nvdata, len);
        error = bxe_nvram_write(sc,
                                (uint8_t *)nvdata->value,


    copyin(ifr->ifr_data, &priv_op, sizeof(priv_op));

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list