svn commit: r199712 - stable/6/sys/compat/pecoff
Bjoern A. Zeeb
bz at FreeBSD.org
Mon Nov 23 11:52:21 UTC 2009
Author: bz
Date: Mon Nov 23 11:52:20 2009
New Revision: 199712
URL: http://svn.freebsd.org/changeset/base/199712
Log:
MF7 r199330:
Note: this change was never in head; thus directly merged from stable/7.
As we pass the 'offset' unvalidated to vn_rdwr() make sure
that it is unsigned rather than possibly set to something negative
by a malicious binary.
This is just the immediate fix to the problem mentioned in
PR kern/80742 and by http://milw0rm.com/exploits/9206 but does
not fix all possible problems imgact_pecoff has.
As this feature does not work and is not compiled in by default,
the security team considers this vulnerability to be of low risk
to the user population and will not be issuing an advisory.
PR: kern/80742
Reported by: Oliver Pinter (oliver.pntr gmail.com) via freebsd-security
Help reproducing and testing by: Damian Weber (dweber htw-saarland.de)
Modified:
stable/6/sys/compat/pecoff/imgact_pecoff.c
Directory Properties:
stable/6/sys/ (props changed)
stable/6/sys/conf/ (props changed)
stable/6/sys/contrib/pf/ (props changed)
stable/6/sys/dev/cxgb/ (props changed)
Modified: stable/6/sys/compat/pecoff/imgact_pecoff.c
==============================================================================
--- stable/6/sys/compat/pecoff/imgact_pecoff.c Mon Nov 23 09:45:59 2009 (r199711)
+++ stable/6/sys/compat/pecoff/imgact_pecoff.c Mon Nov 23 11:52:20 2009 (r199712)
@@ -135,7 +135,7 @@ exec_pecoff_coff_makecmds(struct image_p
struct coff_filehdr *, int);
static int pecoff_signature(struct thread *, struct vnode *, const struct pecoff_dos_filehdr *);
-static int pecoff_read_from(struct thread *, struct vnode *, int, caddr_t, int);
+static int pecoff_read_from(struct thread *, struct vnode *, unsigned int, caddr_t, int);
static int
pecoff_load_section(struct thread * td,
struct vmspace * vmspace, struct vnode * vp,
@@ -291,7 +291,7 @@ pecoff_load_file(struct thread * td, con
struct vmspace *vmspace = td->td_proc->p_vmspace;
struct vattr attr;
struct image_params image_params, *imgp;
- int peofs;
+ unsigned int peofs;
int error, i, scnsiz;
imgp = &image_params;
@@ -549,7 +549,7 @@ int
pecoff_read_from(td, vp, pos, buf, siz)
struct thread *td;
struct vnode *vp;
- int pos;
+ unsigned int pos;
caddr_t buf;
int siz;
{
More information about the svn-src-stable-6
mailing list