FreeBSD Kernel buffer overflow

[Don Lewis]

On 20 Sep, gerarra at tin.it wrote:

>> cat kern_syscalls.diff
> --- kern_syscalls.c     Sat Sep 18 13:42:21 2004
> +++ kern_syscalls2.c    Mon Sep 20 14:18:45 2004
> @@ -58,6 +58,16 @@
>  syscall_register(int *offset, struct sysent *new_sysent,
>                  struct sysent *old_sysent)
>  {
> +#ifndef __ia64__
> +       if (new_sysent->sy_narg < 0 || new_sysent->sy_narg > MAX_SYSCALL_ARGS)
> +       {
> +               printf("Invalid sy_narg for syscall: boundary is [0 - %d]\n",
> +                       MAX_SYSCALL_ARGS);
> +               return EINVAL;
> +       }
> +#endif
> +
> +

It would probably be better to change the #ifndef to
	#ifdef MAX_SYSCALL_ARGS

I would also add new_sysent->sy_narg to the printf().