Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
ebcc6a8e1a
NetBSD/common/lib/libprop/Makefile.inc

10 lines
274 B
PHP
Raw Normal View History

libprop is currently using a recursive parser. While this is fine for userland, deeply nested arrays and dictionaries can easily overflow the kernel stack and thereby force a panic. Fix the internalizer and prop_object_release to use a separate call stack and alter the dictionary and array handling to not recurse on the C stack. The default stack has an inline depth of 16 elements, which should keep the overhead reasonable. This issue was found by Pavel Cahyna and Jachym Holecek. Additionally add a limit for prop_object_copyin_ioctl to prevent user programs from temporary allocating unbound amount of kernel memory. Allow malloc to fail so that tight loops of userland processes can't force panics by exhausting the kernel map. Tested with the sample exploit of Jachym, his test suite and reviewed by himself (initial patch), Christos Zoulas and Jason Thorpe.
2007-08-17 01:44:06 +04:00
# $NetBSD: Makefile.inc,v 1.6 2007/08/16 21:44:06 joerg Exp $
Initial commit of proplib, a library for manipulating property lists and converting to/from an XML external representation (based on Apple XML property lists). Works in the kernel and user space.
2006-04-28 00:11:27 +04:00
.PATH: ${.PARSEDIR}
SRCS+= prop_array.c prop_bool.c prop_data.c prop_dictionary.c \
- Add prop_dictionary_all_keys(). Takes a snapshot of a dictionary's keys and returns them in an array. This effectively allows a caller to mutate a dictionary while iterating over it (really, you iterate over the array of keys instead of the dictionary itself). - Add a slew of utility functions that make it more convenient (in some circumstances, anyway) to get/set values in a dictionary.
2006-10-26 09:02:12 +04:00
prop_dictionary_util.c prop_ingest.c prop_kern.c prop_number.c \
libprop is currently using a recursive parser. While this is fine for userland, deeply nested arrays and dictionaries can easily overflow the kernel stack and thereby force a panic. Fix the internalizer and prop_object_release to use a separate call stack and alter the dictionary and array handling to not recurse on the C stack. The default stack has an inline depth of 16 elements, which should keep the overhead reasonable. This issue was found by Pavel Cahyna and Jachym Holecek. Additionally add a limit for prop_object_copyin_ioctl to prevent user programs from temporary allocating unbound amount of kernel memory. Allow malloc to fail so that tight loops of userland processes can't force panics by exhausting the kernel map. Tested with the sample exploit of Jachym, his test suite and reviewed by himself (initial patch), Christos Zoulas and Jason Thorpe.
2007-08-17 01:44:06 +04:00
prop_object.c prop_stack.c prop_string.c
Adapt Matt Thomas's red-black tree implementation for use in proplib. This has a significant code size savings over <sys/tree.h>. Also change prop_number_t to store all number objects in an r-b tree, only ever allocating one object for any given number (we can do this because numbers are immutable). This results in significant run-time memory savings.
2006-09-09 10:59:28 +04:00
SRCS+= prop_rb.c
Reference in New Issue Copy Permalink