[Bug 209113] Heap overflow in geom ioctl handler
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Wed Jul 20 21:02:24 UTC 2016
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=209113
--- Comment #4 from rday <ryan at ryanday.net> ---
I think you're right, a hard limit would be better. I can't find a maximum
parameter count or a maximum parameter size in the documentation though. I
don't think I'm familiar enough with the system to come up with a value.
On the other hand, if root issues a malicious ioctl() then root's process just
waits(using M_WAITOK). This doesn't seem like much of a concern.
Lacking a sufficient hard limit, would it be best to simply change the `size`
parameter's type to size_t? Removing the M_NOWAIT change?
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-geom
mailing list