aboutsummaryrefslogtreecommitdiffstats
path: root/sys
diff options
context:
space:
mode:
authorXin LI <delphij@FreeBSD.org>2015-02-25 05:56:54 +0000
committerXin LI <delphij@FreeBSD.org>2015-02-25 05:56:54 +0000
commitfec769336cf1605c74783ada99c03ae271530889 (patch)
treea947fa79fbc17d160b0ebc756df96ab23bd6e1f4 /sys
parentfc751aec5cacb72bc582d6b2eedbe57c2f0d9974 (diff)
downloadsrc-fec769336cf1605c74783ada99c03ae271530889.tar.gz
src-fec769336cf1605c74783ada99c03ae271530889.zip
Fix integer overflow in IGMP protocol. [SA-15:04]
Fix BIND remote denial of service vulnerability. [SA-15:05] Fix vt(4) crash with improper ioctl parameters. [EN-15:01] Updated base system OpenSSL to 0.9.8zd. [EN-15:02] Fix freebsd-update libraries update ordering issue. [EN-15:03] Approved by: so
Notes
Notes: svn path=/releng/9.3/; revision=279265
Diffstat (limited to 'sys')
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/dev/vt/vt_core.c13
-rw-r--r--sys/netinet/igmp.c4
3 files changed, 11 insertions, 8 deletions
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index e0a9b4c2fcf5..956b86319555 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="9.3"
-BRANCH="RELEASE-p9"
+BRANCH="RELEASE-p10"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
diff --git a/sys/dev/vt/vt_core.c b/sys/dev/vt/vt_core.c
index eb2843edaabf..dd531ea5112e 100644
--- a/sys/dev/vt/vt_core.c
+++ b/sys/dev/vt/vt_core.c
@@ -1719,20 +1719,23 @@ skip_thunk:
}
VT_UNLOCK(vd);
return (EINVAL);
- case VT_WAITACTIVE:
+ case VT_WAITACTIVE: {
+ unsigned int idx;
+
error = 0;
- i = *(unsigned int *)data;
- if (i > VT_MAXWINDOWS)
+ idx = *(unsigned int *)data;
+ if (idx > VT_MAXWINDOWS)
return (EINVAL);
- if (i != 0)
- vw = vd->vd_windows[i - 1];
+ if (idx > 0)
+ vw = vd->vd_windows[idx - 1];
VT_LOCK(vd);
while (vd->vd_curwindow != vw && error == 0)
error = cv_wait_sig(&vd->vd_winswitch, &vd->vd_lock);
VT_UNLOCK(vd);
return (error);
+ }
case VT_SETMODE: { /* set screen switcher mode */
struct vt_mode *mode;
struct proc *p1;
diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c
index 94c00a112751..3ba1002363be 100644
--- a/sys/netinet/igmp.c
+++ b/sys/netinet/igmp.c
@@ -1533,8 +1533,8 @@ igmp_input(struct mbuf *m, int off)
case IGMP_VERSION_3: {
struct igmpv3 *igmpv3;
uint16_t igmpv3len;
- uint16_t srclen;
- int nsrc;
+ uint16_t nsrc;
+ int srclen;
IGMPSTAT_INC(igps_rcv_v3_queries);
igmpv3 = (struct igmpv3 *)igmp;