From owner-svn-src-user@FreeBSD.ORG  Sat Feb 21 10:10:27 2015
Return-Path: <owner-svn-src-user@FreeBSD.ORG>
Delivered-To: svn-src-user@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 4F18BD83;
 Sat, 21 Feb 2015 10:10:27 +0000 (UTC)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 3AECEFCF;
 Sat, 21 Feb 2015 10:10:27 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t1LAARwv058154;
 Sat, 21 Feb 2015 10:10:27 GMT (envelope-from dchagin@FreeBSD.org)
Received: (from dchagin@localhost)
 by svn.freebsd.org (8.14.9/8.14.9/Submit) id t1LAAR2U058153;
 Sat, 21 Feb 2015 10:10:27 GMT (envelope-from dchagin@FreeBSD.org)
Message-Id: <201502211010.t1LAAR2U058153@svn.freebsd.org>
X-Authentication-Warning: svn.freebsd.org: dchagin set sender to
 dchagin@FreeBSD.org using -f
From: Dmitry Chagin <dchagin@FreeBSD.org>
Date: Sat, 21 Feb 2015 10:10:27 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-user@freebsd.org
Subject: svn commit: r279102 - user/dchagin/lemul/sys/compat/linprocfs
X-SVN-Group: user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-user@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "SVN commit messages for the experimental &quot; user&quot;
 src tree" <svn-src-user.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-user>,
 <mailto:svn-src-user-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-user/>
List-Post: <mailto:svn-src-user@freebsd.org>
List-Help: <mailto:svn-src-user-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-user>,
 <mailto:svn-src-user-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 21 Feb 2015 10:10:27 -0000

Author: dchagin
Date: Sat Feb 21 10:10:26 2015
New Revision: 279102
URL: https://svnweb.freebsd.org/changeset/base/279102

Log:
  Add a resid bounds checking to doprocauxv() method.

Modified:
  user/dchagin/lemul/sys/compat/linprocfs/linprocfs.c

Modified: user/dchagin/lemul/sys/compat/linprocfs/linprocfs.c
==============================================================================
--- user/dchagin/lemul/sys/compat/linprocfs/linprocfs.c	Sat Feb 21 09:25:53 2015	(r279101)
+++ user/dchagin/lemul/sys/compat/linprocfs/linprocfs.c	Sat Feb 21 10:10:26 2015	(r279102)
@@ -1405,7 +1405,7 @@ static int
 linprocfs_doauxv(PFS_FILL_ARGS)
 {
 	struct sbuf *asb;
-	off_t buflen;
+	off_t buflen, resid;
 	int error;
 
 	/*
@@ -1419,11 +1419,6 @@ linprocfs_doauxv(PFS_FILL_ARGS)
 		return (0);
 	if (uio->uio_offset < 0 || uio->uio_resid < 0)
 		return (EINVAL);
-	buflen = uio->uio_resid;
-	if (buflen > IOSIZE_MAX)
-		return (EINVAL);
-	if (buflen > MAXPHYS)
-		buflen = MAXPHYS;
 
 	asb = sbuf_new_auto();
 	if (asb == NULL)
@@ -1431,6 +1426,19 @@ linprocfs_doauxv(PFS_FILL_ARGS)
 	error = proc_getauxv(td, p, asb);
 	if (error == 0)
 		error = sbuf_finish(asb);
+
+	resid = sbuf_len(asb) - uio->uio_offset;
+	if (resid > uio->uio_resid)
+		buflen = uio->uio_resid;
+	else
+		buflen = resid;
+	if (buflen > IOSIZE_MAX)
+		return (EINVAL);
+	if (buflen > MAXPHYS)
+		buflen = MAXPHYS;
+	if (resid <= 0)
+		return (0);
+
 	if (error == 0)
 		error = uiomove(sbuf_data(asb) + uio->uio_offset, buflen, uio);
 	sbuf_delete(asb);