Page MenuHomeFreeBSD

pf: Do not allow negative ps_len in DIOCGETSTATES
ClosedPublic

Authored by kp on Apr 16 2020, 7:29 PM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 20 2023, 6:57 AM
Unknown Object (File)
Aug 25 2023, 8:47 PM
Unknown Object (File)
Jul 2 2023, 1:01 PM
Unknown Object (File)
May 10 2023, 4:44 AM
Unknown Object (File)
Jan 1 2023, 10:30 AM

Details

Summary

Userspace may pass a negative ps_len value to us, which causes an
assertion failure in malloc().
Treat negative values as zero, i.e. return the required size.

Reported-by: syzbot+53370d9d0358ee2a059a@syzkaller.appspotmail.com

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable