svn commit: r278976 - in head/sys: amd64/amd64 i386/i386
John Baldwin
jhb at FreeBSD.org
Wed Feb 18 23:34:04 UTC 2015
Author: jhb
Date: Wed Feb 18 23:34:03 2015
New Revision: 278976
URL: https://svnweb.freebsd.org/changeset/base/278976
Log:
Ensure that the supplied data length is large enough to hold the base
FPU state to avoid passing a negative length to fpusetregs() / npxsetregs().
Differential Revision: https://reviews.freebsd.org/D1861
Reviewed by: kib, emaste
Modified:
head/sys/amd64/amd64/ptrace_machdep.c
head/sys/i386/i386/ptrace_machdep.c
Modified: head/sys/amd64/amd64/ptrace_machdep.c
==============================================================================
--- head/sys/amd64/amd64/ptrace_machdep.c Wed Feb 18 23:10:15 2015 (r278975)
+++ head/sys/amd64/amd64/ptrace_machdep.c Wed Feb 18 23:34:03 2015 (r278976)
@@ -88,7 +88,8 @@ cpu_ptrace_xstate(struct thread *td, int
break;
case PT_SETXSTATE:
- if (data > cpu_max_ext_state_size) {
+ if (data < sizeof(struct savefpu) ||
+ data > cpu_max_ext_state_size) {
error = EINVAL;
break;
}
Modified: head/sys/i386/i386/ptrace_machdep.c
==============================================================================
--- head/sys/i386/i386/ptrace_machdep.c Wed Feb 18 23:10:15 2015 (r278975)
+++ head/sys/i386/i386/ptrace_machdep.c Wed Feb 18 23:34:03 2015 (r278976)
@@ -92,7 +92,8 @@ cpu_ptrace_xstate(struct thread *td, int
break;
case PT_SETXSTATE:
- if (data > cpu_max_ext_state_size) {
+ if (data < sizeof(union savefpu) ||
+ data > cpu_max_ext_state_size) {
error = EINVAL;
break;
}
More information about the svn-src-head
mailing list