diff options
| author | Dag-Erling Smørgrav <des@FreeBSD.org> | 2014-11-04 23:32:45 +0000 |
|---|---|---|
| committer | Dag-Erling Smørgrav <des@FreeBSD.org> | 2014-11-04 23:32:45 +0000 |
| commit | 7cebf7e583e85beb2434c3dac21c4e3db1873134 (patch) | |
| tree | 7737d959c3d040d766284ccbee58db8287d7a6f7 /sys/kern/kern_prot.c | |
| parent | eb5534a05f5ce0574f09cf0beecf2e4758abf670 (diff) | |
| download | src-7cebf7e583e85beb2434c3dac21c4e3db1873134.tar.gz src-7cebf7e583e85beb2434c3dac21c4e3db1873134.zip | |
[SA-14:24] Fix denial of service attack against sshd(8).
[SA-14:25] Fix kernel stack disclosure in setlogin(2) / getlogin(2).
[SA-14:26] Fix remote command execution in ftp(1).
[EN-14:12] Fix NFSv4 and ZFS cache consistency issue.
Approved by: so (des)
Notes
Notes:
svn path=/releng/9.1/; revision=274112
Diffstat (limited to 'sys/kern/kern_prot.c')
| -rw-r--r-- | sys/kern/kern_prot.c | 31 |
1 files changed, 17 insertions, 14 deletions
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index cf939844576b..c658755bc042 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -2073,19 +2073,20 @@ struct getlogin_args { int sys_getlogin(struct thread *td, struct getlogin_args *uap) { - int error; char login[MAXLOGNAME]; struct proc *p = td->td_proc; + size_t len; if (uap->namelen > MAXLOGNAME) uap->namelen = MAXLOGNAME; PROC_LOCK(p); SESS_LOCK(p->p_session); - bcopy(p->p_session->s_login, login, uap->namelen); + len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; SESS_UNLOCK(p->p_session); PROC_UNLOCK(p); - error = copyout(login, uap->namebuf, uap->namelen); - return(error); + if (len > uap->namelen) + return (ERANGE); + return (copyout(login, uap->namebuf, len)); } /* @@ -2104,21 +2105,23 @@ sys_setlogin(struct thread *td, struct setlogin_args *uap) int error; char logintmp[MAXLOGNAME]; + CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); + error = priv_check(td, PRIV_PROC_SETLOGIN); if (error) return (error); error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); - if (error == ENAMETOOLONG) - error = EINVAL; - else if (!error) { - PROC_LOCK(p); - SESS_LOCK(p->p_session); - (void) memcpy(p->p_session->s_login, logintmp, - sizeof(logintmp)); - SESS_UNLOCK(p->p_session); - PROC_UNLOCK(p); + if (error != 0) { + if (error == ENAMETOOLONG) + error = EINVAL; + return (error); } - return (error); + PROC_LOCK(p); + SESS_LOCK(p->p_session); + strcpy(p->p_session->s_login, logintmp); + SESS_UNLOCK(p->p_session); + PROC_UNLOCK(p); + return (0); } void |