aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGordon Tetlow <gordon@FreeBSD.org>2018-04-04 05:33:56 +0000
committerGordon Tetlow <gordon@FreeBSD.org>2018-04-04 05:33:56 +0000
commita500153f5edf1c468350f1f60ca54f0c3a9dda7b (patch)
tree796cc2d9bb7c3f41d9d9714929ccd8ef12fb546b
parent139e67194b734663843bad9ee59676d9d440e109 (diff)
downloadsrc-a500153f5edf1c468350f1f60ca54f0c3a9dda7b.tar.gz
src-a500153f5edf1c468350f1f60ca54f0c3a9dda7b.zip
Fix vt console memory disclosure. [SA-18:04.vt]
Bump newvers.sh and UPDATING for today's patches. Submitted by: emaste Reported by: Dr Silvio Cesare of InfoSect Approved by: so Security: CVE-2018-6917 Security: FreeBSD-SA-18:04.vt Sponsored by: The FreeBSD Foundation
Notes
Notes: svn path=/releng/10.3/; revision=331984
-rw-r--r--UPDATING13
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/dev/vt/vt_font.c4
3 files changed, 17 insertions, 2 deletions
diff --git a/UPDATING b/UPDATING
index ee53982a5fd6..18ad877b2eae 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,19 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of
stable/10, and then rebuild without this option. The bootstrap process from
older version of current is a bit fragile.
+20180404 p29 FreeBSD-SA-18:04.vt
+ FreeBSD-SA-18:05.ipsec
+ FreeBSD-EN-18:03.tzdata
+ FreeBSD-EN-18:04.mem
+
+ Fix vt console memory disclosure. [SA-18:04.vt]
+
+ Fix ipsec crash or denial of service. [SA-18:05.ipsec]
+
+ Update timezone database information. [EN-18:03.tzdata]
+
+ Fix multiple small kernel memory disclosures. [EN-18:04.mem]
+
20180308 p28 FreeBSD-SA-18:01.ipsec [revised]
Fix ipsec validation and use-after-free.
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index be0f7991b05b..b105b280c66c 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="10.3"
-BRANCH="RELEASE-p28"
+BRANCH="RELEASE-p29"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
diff --git a/sys/dev/vt/vt_font.c b/sys/dev/vt/vt_font.c
index 4c369c68bdb2..1e65e70cfe2c 100644
--- a/sys/dev/vt/vt_font.c
+++ b/sys/dev/vt/vt_font.c
@@ -42,6 +42,7 @@ static MALLOC_DEFINE(M_VTFONT, "vtfont", "vt font");
/* Some limits to prevent abnormal fonts from being loaded. */
#define VTFONT_MAXMAPPINGS 65536
+#define VTFONT_MAXGLYPHS 131072
#define VTFONT_MAXGLYPHSIZE 2097152
#define VTFONT_MAXDIMENSION 128
@@ -171,7 +172,8 @@ vtfont_load(vfnt_t *f, struct vt_font **ret)
/* Make sure the dimensions are valid. */
if (f->width < 1 || f->height < 1)
return (EINVAL);
- if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION)
+ if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION ||
+ f->glyph_count > VTFONT_MAXGLYPHS)
return (E2BIG);
/* Not too many mappings. */