diff options
| author | Colin Percival <cperciva@FreeBSD.org> | 2005-05-06 02:40:32 +0000 |
|---|---|---|
| committer | Colin Percival <cperciva@FreeBSD.org> | 2005-05-06 02:40:32 +0000 |
| commit | c7be66d1904c2bc85c73040d0b98529bd9ad5a92 (patch) | |
| tree | 5f042d43c9dd5dc130c67d1a2ac4af8379545dc9 /sys/i386 | |
| parent | e0b13f513277ce4d0fe927cfc88835670f24a08e (diff) | |
| download | src-c7be66d1904c2bc85c73040d0b98529bd9ad5a92.tar.gz src-c7be66d1904c2bc85c73040d0b98529bd9ad5a92.zip | |
Correctly validate inputs to the i386_get_ldt syscall.
Security: FreeBSD-SA-05:07.ldt
Approved by: so (cperciva)
Notes
Notes:
svn path=/releng/4.11/; revision=145951
Diffstat (limited to 'sys/i386')
| -rw-r--r-- | sys/i386/i386/sys_machdep.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c index f87e333cbf88..a9dcf48254a3 100644 --- a/sys/i386/i386/sys_machdep.c +++ b/sys/i386/i386/sys_machdep.c @@ -342,10 +342,6 @@ i386_get_ldt(p, args) uap->start, uap->num, (void *)uap->descs); #endif - /* verify range of LDTs exist */ - if ((uap->start < 0) || (uap->num <= 0)) - return(EINVAL); - s = splhigh(); if (pcb_ldt) { @@ -357,7 +353,10 @@ i386_get_ldt(p, args) num = min(uap->num, nldt); lp = &ldt[uap->start]; } - if (uap->start + num > nldt) { + + if ((uap->start > (unsigned int)nldt) || + ((unsigned int)num > (unsigned int)nldt) || + ((unsigned int)(uap->start + num) > (unsigned int)nldt)) { splx(s); return(EINVAL); } |