svn commit: r278976 - in head/sys: amd64/amd64 i386/i386

John Baldwin jhb at FreeBSD.org
Wed Feb 18 23:34:04 UTC 2015


Author: jhb
Date: Wed Feb 18 23:34:03 2015
New Revision: 278976
URL: https://svnweb.freebsd.org/changeset/base/278976

Log:
  Ensure that the supplied data length is large enough to hold the base
  FPU state to avoid passing a negative length to fpusetregs() / npxsetregs().
  
  Differential Revision:	https://reviews.freebsd.org/D1861
  Reviewed by:	kib, emaste

Modified:
  head/sys/amd64/amd64/ptrace_machdep.c
  head/sys/i386/i386/ptrace_machdep.c

Modified: head/sys/amd64/amd64/ptrace_machdep.c
==============================================================================
--- head/sys/amd64/amd64/ptrace_machdep.c	Wed Feb 18 23:10:15 2015	(r278975)
+++ head/sys/amd64/amd64/ptrace_machdep.c	Wed Feb 18 23:34:03 2015	(r278976)
@@ -88,7 +88,8 @@ cpu_ptrace_xstate(struct thread *td, int
 		break;
 
 	case PT_SETXSTATE:
-		if (data > cpu_max_ext_state_size) {
+		if (data < sizeof(struct savefpu) ||
+		    data > cpu_max_ext_state_size) {
 			error = EINVAL;
 			break;
 		}

Modified: head/sys/i386/i386/ptrace_machdep.c
==============================================================================
--- head/sys/i386/i386/ptrace_machdep.c	Wed Feb 18 23:10:15 2015	(r278975)
+++ head/sys/i386/i386/ptrace_machdep.c	Wed Feb 18 23:34:03 2015	(r278976)
@@ -92,7 +92,8 @@ cpu_ptrace_xstate(struct thread *td, int
 		break;
 
 	case PT_SETXSTATE:
-		if (data > cpu_max_ext_state_size) {
+		if (data < sizeof(union savefpu) ||
+		    data > cpu_max_ext_state_size) {
 			error = EINVAL;
 			break;
 		}


More information about the svn-src-head mailing list