aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGleb Smirnoff <glebius@FreeBSD.org>2016-12-06 18:49:48 +0000
committerGleb Smirnoff <glebius@FreeBSD.org>2016-12-06 18:49:48 +0000
commit6cc6b6209e4425e2caf61835e9c58f1bc7544d5e (patch)
tree9e1428b58013365e340bfb13bda0891a8e9149ce
parent0daaada21b572e3e70623c57635c09c4879f15e8 (diff)
downloadsrc-6cc6b6209e4425e2caf61835e9c58f1bc7544d5e.tar.gz
src-6cc6b6209e4425e2caf61835e9c58f1bc7544d5e.zip
Fix possible login(1) argument injection in telnetd(8). [SA-16:36]
Fix link_ntoa(3) buffer overflow in libc. [SA-16:37] Fix possible escape from bhyve(8) virtual machine. [SA-16:38] Fix warnings about valid time zone abbreviations. [EN-16:19] Update timezone database information. [EN-16:20] Security: FreeBSD-SA-16:36.telnetd Security: FreeBSD-SA-16:37.libc Security: FreeBSD-SA-16:38.bhyve Errata Notice: FreeBSD-EN-16:19.tzcode Errata Notice: FreeBSD-EN-16:20.tzdata Approved by: so
Notes
Notes: svn path=/releng/10.3/; revision=309634
-rw-r--r--UPDATING12
-rw-r--r--contrib/telnet/telnetd/sys_term.c7
-rw-r--r--lib/libc/net/linkaddr.c51
-rw-r--r--lib/libvmmapi/vmmapi.c11
-rw-r--r--sys/conf/newvers.sh2
5 files changed, 59 insertions, 24 deletions
diff --git a/UPDATING b/UPDATING
index fb7ad5151451..2a5abe5dbe09 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,18 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of
stable/10, and then rebuild without this option. The bootstrap process from
older version of current is a bit fragile.
+20161206 p13 FreeBSD-SA-16:36.telnetd
+ FreeBSD-SA-16:37.libc
+ FreeBSD-SA-16:38.bhyve
+ FreeBSD-EN-16:19.tzcode
+ FreeBSD-EN-16:20.tzdata
+
+ Fix possible login(1) argument injection in telnetd(8). [SA-16:36]
+ Fix link_ntoa(3) buffer overflow in libc. [SA-16:37]
+ Fix possible escape from bhyve(8) virtual machine. [SA-16:38]
+ Fix warnings about valid time zone abbreviations. [EN-16:19]
+ Update timezone database information. [EN-16:20]
+
20161102 p12 FreeBSD-SA-16:33.openssh
FreeBSD-SA-16:35.openssl
diff --git a/contrib/telnet/telnetd/sys_term.c b/contrib/telnet/telnetd/sys_term.c
index f9b9461c351e..a2e551f7919f 100644
--- a/contrib/telnet/telnetd/sys_term.c
+++ b/contrib/telnet/telnetd/sys_term.c
@@ -1159,7 +1159,7 @@ addarg(char **argv, const char *val)
*/
argv = (char **)malloc(sizeof(*argv) * 12);
if (argv == NULL)
- return(NULL);
+ fatal(net, "failure allocating argument space");
*argv++ = (char *)10;
*argv = (char *)0;
}
@@ -1170,11 +1170,12 @@ addarg(char **argv, const char *val)
*argv = (char *)((long)(*argv) + 10);
argv = (char **)realloc(argv, sizeof(*argv)*((long)(*argv) + 2));
if (argv == NULL)
- return(NULL);
+ fatal(net, "failure allocating argument space");
argv++;
cpp = &argv[(long)argv[-1] - 10];
}
- *cpp++ = strdup(val);
+ if ((*cpp++ = strdup(val)) == NULL)
+ fatal(net, "failure allocating argument space");
*cpp = 0;
return(argv);
}
diff --git a/lib/libc/net/linkaddr.c b/lib/libc/net/linkaddr.c
index 5be6e74114e1..f14f22de279f 100644
--- a/lib/libc/net/linkaddr.c
+++ b/lib/libc/net/linkaddr.c
@@ -35,6 +35,7 @@ __FBSDID("$FreeBSD$");
#include <sys/types.h>
#include <sys/socket.h>
+#include <net/if.h>
#include <net/if_dl.h>
#include <string.h>
@@ -125,31 +126,47 @@ link_ntoa(sdl)
const struct sockaddr_dl *sdl;
{
static char obuf[64];
- char *out = obuf;
- int i;
- u_char *in = (u_char *)LLADDR(sdl);
- u_char *inlim = in + sdl->sdl_alen;
- int firsttime = 1;
+ _Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
+ char *out;
+ const char *in, *inlim;
+ int namelen, i, rem;
- if (sdl->sdl_nlen) {
- bcopy(sdl->sdl_data, obuf, sdl->sdl_nlen);
- out += sdl->sdl_nlen;
- if (sdl->sdl_alen)
+ namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
+
+ out = obuf;
+ rem = sizeof(obuf);
+ if (namelen > 0) {
+ bcopy(sdl->sdl_data, out, namelen);
+ out += namelen;
+ rem -= namelen;
+ if (sdl->sdl_alen > 0) {
*out++ = ':';
+ rem--;
+ }
}
- while (in < inlim) {
- if (firsttime)
- firsttime = 0;
- else
+
+ in = (const char *)sdl->sdl_data + sdl->sdl_nlen;
+ inlim = in + sdl->sdl_alen;
+
+ while (in < inlim && rem > 1) {
+ if (in != (const char *)sdl->sdl_data + sdl->sdl_nlen) {
*out++ = '.';
+ rem--;
+ }
i = *in++;
if (i > 0xf) {
- out[1] = hexlist[i & 0xf];
+ if (rem < 3)
+ break;
+ *out++ = hexlist[i & 0xf];
i >>= 4;
- out[0] = hexlist[i];
- out += 2;
- } else
*out++ = hexlist[i];
+ rem -= 2;
+ } else {
+ if (rem < 2)
+ break;
+ *out++ = hexlist[i];
+ rem++;
+ }
}
*out = 0;
return (obuf);
diff --git a/lib/libvmmapi/vmmapi.c b/lib/libvmmapi/vmmapi.c
index fb8eb787a1d6..33a3b44e18bb 100644
--- a/lib/libvmmapi/vmmapi.c
+++ b/lib/libvmmapi/vmmapi.c
@@ -427,13 +427,18 @@ vm_map_gpa(struct vmctx *ctx, vm_paddr_t gaddr, size_t len)
{
if (ctx->lowmem > 0) {
- if (gaddr < ctx->lowmem && gaddr + len <= ctx->lowmem)
+ if (gaddr < ctx->lowmem && len <= ctx->lowmem &&
+ gaddr + len <= ctx->lowmem)
return (ctx->baseaddr + gaddr);
}
if (ctx->highmem > 0) {
- if (gaddr >= 4*GB && gaddr + len <= 4*GB + ctx->highmem)
- return (ctx->baseaddr + gaddr);
+ if (gaddr >= 4*GB) {
+ if (gaddr < 4*GB + ctx->highmem &&
+ len <= ctx->highmem &&
+ gaddr + len <= 4*GB + ctx->highmem)
+ return (ctx->baseaddr + gaddr);
+ }
}
return (NULL);
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 3dffb6b05f74..87777eb1185b 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="10.3"
-BRANCH="RELEASE-p12"
+BRANCH="RELEASE-p13"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi