From owner-freebsd-security  Sun Sep  5  9:38:21 1999
Delivered-To: freebsd-security@freebsd.org
Received: from apollo.backplane.com (apollo.backplane.com [209.157.86.2])
	by hub.freebsd.org (Postfix) with ESMTP
	id 54A9614E77; Sun,  5 Sep 1999 09:38:20 -0700 (PDT)
	(envelope-from dillon@apollo.backplane.com)
Received: (from dillon@localhost)
	by apollo.backplane.com (8.9.3/8.9.1) id JAA68325;
	Sun, 5 Sep 1999 09:37:48 -0700 (PDT)
	(envelope-from dillon)
Date: Sun, 5 Sep 1999 09:37:48 -0700 (PDT)
From: Matthew Dillon <dillon@apollo.backplane.com>
Message-Id: <199909051637.JAA68325@apollo.backplane.com>
To: "Brian F. Feldman" <green@FreeBSD.org>
Cc: Garrett Wollman <wollman@khavrinen.lcs.mit.edu>,
	Nick Hibma <hibma@skylink.it>,
	FreeBSD -- The Power to Serve <geniusj@free-bsd.org>,
	Mike Tancsa <mike@sentex.net>, freebsd-security@FreeBSD.org
Subject: Re: FW: Local DoS in FreeBSD
References:  <Pine.BSF.4.10.9909050747260.86690-100000@janus.syracuse.net>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


:>     old value of ui_sbsize when uip is not NULL.  That may make the
:>     problem more obvious.
:
:I've gdb'd every crash and it's been something like ui_sbsize = 0x1234
:delta = -0x2000.
:
: Brian Fundakowski Feldman           /  "Any sufficiently advanced bug is    \

    0x1234 could be an indication of a reference to a data structure 
    which has been freed.
	
					-Matt
					Matthew Dillon 
					<dillon@backplane.com>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message