svn commit: r297458 - head/sys/kern

[Edward Tomasz Napierala]

Author: trasz
Date: Thu Mar 31 17:00:47 2016
New Revision: 297458
URL: https://svnweb.freebsd.org/changeset/base/297458

Log:
  Fix overflows, making it impossible to add negative amounts using rctl(8).
  
  MFC after:	1 month
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/kern/kern_rctl.c

Modified: head/sys/kern/kern_rctl.c
==============================================================================
--- head/sys/kern/kern_rctl.c	Thu Mar 31 16:44:32 2016	(r297457)
+++ head/sys/kern/kern_rctl.c	Thu Mar 31 17:00:47 2016	(r297458)
@@ -642,6 +642,9 @@ str2int64(const char *str, int64_t *valu
 	if ((size_t)(end - str) != strlen(str))
 		return (EINVAL);
 
+	if (*value < 0)
+		return (ERANGE);
+
 	return (0);
 }
 
@@ -1008,8 +1011,13 @@ rctl_string_to_rule(char *rulestr, struc
 		error = str2int64(amountstr, &rule->rr_amount);
 		if (error != 0)
 			goto out;
-		if (RACCT_IS_IN_MILLIONS(rule->rr_resource))
+		if (RACCT_IS_IN_MILLIONS(rule->rr_resource)) {
+			if (rule->rr_amount > INT64_MAX / 1000000) {
+				error = ERANGE;
+				goto out;
+			}
 			rule->rr_amount *= 1000000;
+		}
 	}
 
 	if (perstr == NULL || perstr[0] == '\0')