From owner-svn-src-all@freebsd.org Tue May 17 23:10:10 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 503CBB40CE4; Tue, 17 May 2016 23:10:10 +0000 (UTC) (envelope-from bdrewery@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 406A519F8; Tue, 17 May 2016 23:10:10 +0000 (UTC) (envelope-from bdrewery@FreeBSD.org) Received: from mail.xzibition.com (localhost [IPv6:::1]) by freefall.freebsd.org (Postfix) with ESMTP id 3A79D1430; Tue, 17 May 2016 23:10:10 +0000 (UTC) (envelope-from bdrewery@FreeBSD.org) Received: from mail.xzibition.com (localhost [172.31.3.2]) by mail.xzibition.com (Postfix) with ESMTP id 9AE7A1F6D7; Tue, 17 May 2016 23:10:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at mail.xzibition.com Received: from mail.xzibition.com ([172.31.3.2]) by mail.xzibition.com (mail.xzibition.com [172.31.3.2]) (amavisd-new, port 10026) with LMTP id 01lt2HfIdmBm; Tue, 17 May 2016 23:10:06 +0000 (UTC) Subject: Re: svn commit: r300088 - in releng/9.3: . sys/conf sys/dev/kbd DKIM-Filter: OpenDKIM Filter v2.9.2 mail.xzibition.com 5B8B61F6CF To: Gleb Smirnoff References: <201605172228.u4HMSbhj012124@repo.freebsd.org> <14a8d29d-bc14-3f96-57a4-81f1b6dfdd82@FreeBSD.org> <20160517230710.GB1015@FreeBSD.org> Cc: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org From: Bryan Drewery Organization: FreeBSD Message-ID: <38ca6091-5607-5796-9f6e-7f2d6c117707@FreeBSD.org> Date: Tue, 17 May 2016 16:10:05 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.0 MIME-Version: 1.0 In-Reply-To: <20160517230710.GB1015@FreeBSD.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 May 2016 23:10:10 -0000 On 5/17/16 4:07 PM, Gleb Smirnoff wrote: > On Tue, May 17, 2016 at 03:59:26PM -0700, Bryan Drewery wrote: > B> > Author: glebius > B> > Date: Tue May 17 22:28:36 2016 > B> > New Revision: 300088 > B> > URL: https://svnweb.freebsd.org/changeset/base/300088 > B> > > B> > Log: > B> > - Use unsigned version of min() when handling arguments of SETFKEY ioctl. > B> > - Validate that user supplied control message length in sendmsg(2) > B> > is not negative. > B> > B> The sendmsg(2) change is not included here (9.3) nor in the advisory but > B> is in the commit log. Was it intended to be changed in 9.3? > > That was my failure to mention SA-16:19 in commit message for 9.3. It doesn't > apply to 9.x. > > B> Plus the only consumer I see is sendit() which seems to be protected > B> already from negative values when not using COMPAT_43: > B> > B> > if (mp->msg_controllen < sizeof(struct cmsghdr) > B> > #ifdef COMPAT_OLDSOCK > B> > && mp->msg_flags != MSG_COMPAT > B> > #endif > B> > ) { > B> > error = EINVAL; > B> > goto bad; > B> > } > B> > error = sockargs(&control, mp->msg_control, > B> > mp->msg_controllen, MT_CONTROL); > > No, it isn't protected. In the comparison (mp->msg_controllen < sizeof(struct cmsghdr)) > both values are unsigned. Later in sockargs() it is treated as signed. Ah, I see the (u_int)buflen casts on the older code now. Thanks. -- Regards, Bryan Drewery