Date: Mon, 10 Apr 2000 15:49:22 -0700 (PDT) From: Tom Pavel <pavel@NetworkPhysics.COM> To: FreeBSD-gnats-submit@freebsd.org Subject: kern/17911: unitialized var in netgraph msg code Message-ID: <200004102249.PAA00657@cyclone.networkphysics.com>
next in thread | raw e-mail | index | archive | help
>Number: 17911 >Category: kern >Synopsis: unitialized var in netgraph msg code >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Apr 10 16:20:01 PDT 2000 >Closed-Date: >Last-Modified: >Originator: Tom Pavel >Release: FreeBSD 3.4-RELEASE i386 >Organization: Network Physics, Inc. >Environment: Netgraph code in 3.4 or 3-STABLE (same bug in current). Using: $FreeBSD: src/sys/netgraph/ng_base.c,v 1.6.2.9 1999/12/08 19:44:03 julian Exp $ running on i386: cyclone[44]% uname -a FreeBSD cyclone.networkphysics.com 3.4-RELEASE FreeBSD 3.4-RELEASE #7: Mon Apr 10 12:03:55 PDT 2000 root@cyclone.networkphysics.com:/usr/src/sys/compile/NGTEST i386 >Description: The "off" variable in the NGM_ASCII2BINARY case of ng_generic_msg() is unitialized. This can lead to a kernel panic in strtol() (from e.g. ng_int32_parse()) if the variable happens to be initialized to a (nonzero) nonsensical value. >How-To-Repeat: Hook up some netgraph modules, send a bunch of ngctl msg commands with numeric arguments, and wait for the kernel stack to churn a bit. >Fix: --- /sys/netgraph/ng_base.c Wed Dec 8 11:44:03 1999 +++ ng_base.c Mon Apr 10 12:03:19 2000 @@ -1519,7 +1519,7 @@ const struct ng_cmdlist *c; const struct ng_parse_type *argstype; struct ng_mesg *rp, *ascii, *binary; - int off; + int off = 0; /* Data area must contain at least a struct ng_mesg + '\0' */ ascii = (struct ng_mesg *)msg->data; Tom Pavel Network Physics pavel@networkphysics.com / pavel@alum.mit.edu >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200004102249.PAA00657>