Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a user-controlled memory allocation. kmem_alloc(0) will panic the system.

Browse Source 
ok christos@
This commit is contained in:
maxv 2014-07-10 19:12:07 +00:00
parent 0e34796007
commit 2d6d292117
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/kern/sys_module.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: sys_module.c,v 1.14 2012/08/07 01:19:05 jnemeth Exp $ */
/* $NetBSD: sys_module.c,v 1.15 2014/07/10 19:12:07 maxv Exp $ */
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.14 2012/08/07 01:19:05 jnemeth Exp $");
__KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.15 2014/07/10 19:12:07 maxv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -46,6 +46,11 @@ __KERNEL_RCSID(0, "$NetBSD: sys_module.c,v 1.14 2012/08/07 01:19:05 jnemeth Exp
#include <opt_modular.h>
/*
* Arbitrary limit to avoid DoS for excessive memory allocation.
*/
#define MAXPROPSLEN 4096
static int
handle_modctl_load(modctl_load_t *ml)
{
@ -67,7 +72,12 @@ handle_modctl_load(modctl_load_t *ml)
goto out2;
if (ml->ml_props != NULL) {
if (ml->ml_propslen > MAXPROPSLEN) {
error = ENOMEM;
goto out2;
}
propslen = ml->ml_propslen + 1;
props = (char *)kmem_alloc(propslen, KM_SLEEP);
if (props == NULL) {
error = ENOMEM;