HomeFreeBSD

Fix a multitude of security bugs in the iBCS2 emulator:

Description

Fix a multitude of security bugs in the iBCS2 emulator:

  • Return NULL instead of returning memory outside of the stackgap in stackgap_alloc() (FreeBSD-SA-00:42.linux)
  • Check for stackgap_alloc() returning NULL in ibcs2_emul_find(); other calls to stackgap_alloc() have not been changed since they are small fixed-size allocations.
  • Replace use of strcpy() with strlcpy() in exec_coff_imgact() to avoid buffer overflow
  • Use strlcat() instead of strcat() to avoid a one byte buffer overflow in ibcs2_setipdomainname()
  • Use copyinstr() instead of copyin() in ibcs2_setipdomainname() to ensure that the string is null-terminated
  • Avoid integer overflow in ibcs2_setgroups() and ibcs2_setgroups() by checking that gidsetsize argument is non-negative and no larger than NGROUPS_MAX.
  • Range-check signal numbers in ibcs2_wait(), ibcs2_sigaction(), ibcs2_sigsys() and ibcs2_kill() to avoid accessing array past the end (or before the start)

Details

Provenance
Tim J. Robbins <tjr@FreeBSD.org>Authored on Oct 12 2003, 4:25 AM
Parents
rG7f3a5689e7c0: Fix BSS buffer overflow in makeargv().
Branches
Unknown
Tags
Unknown

Event Timeline