svn commit: r302936 - head/sys/kern

[Konstantin Belousov]

Author: kib
Date: Sat Jul 16 13:24:58 2016
New Revision: 302936
URL: https://svnweb.freebsd.org/changeset/base/302936

Log:
  Another issue reported on http://seclists.org/oss-sec/2016/q3/68 is
  that struct kevent member ident has uintptr_t type, which is silently
  truncated to int in the call to fget().  Explicitely check for the
  valid range.
  
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week

Modified:
  head/sys/kern/kern_event.c

Modified: head/sys/kern/kern_event.c
==============================================================================
--- head/sys/kern/kern_event.c	Sat Jul 16 12:25:37 2016	(r302935)
+++ head/sys/kern/kern_event.c	Sat Jul 16 13:24:58 2016	(r302936)
@@ -1183,8 +1183,11 @@ kqueue_register(struct kqueue *kq, struc
 findkn:
 	if (fops->f_isfd) {
 		KASSERT(td != NULL, ("td is NULL"));
-		error = fget(td, kev->ident,
-		    cap_rights_init(&rights, CAP_EVENT), &fp);
+		if (kev->ident > INT_MAX)
+			error = EBADF;
+		else
+			error = fget(td, kev->ident,
+			    cap_rights_init(&rights, CAP_EVENT), &fp);
 		if (error)
 			goto done;