From owner-freebsd-hackers@FreeBSD.ORG  Sat Sep 18 13:41:14 2004
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 952CE16A4CE
	for <freebsd-hackers@freebsd.org>;
	Sat, 18 Sep 2004 13:41:14 +0000 (GMT)
Received: from vsmtp12.tin.it (vsmtp12.tin.it [212.216.176.206])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4BA8543D31
	for <freebsd-hackers@freebsd.org>;
	Sat, 18 Sep 2004 13:41:14 +0000 (GMT)	(envelope-from gerarra@tin.it)
Received: from ims3a.cp.tin.it (192.168.70.103) by vsmtp12.tin.it (7.0.027)
	id 414B19D30004A18E for freebsd-hackers@freebsd.org;
	Sat, 18 Sep 2004 15:41:14 +0200
Received: from [192.168.70.225] by ims3a.cp.tin.it with HTTP;
	Sat, 18 Sep 2004 15:41:14 +0200
Date: Sat, 18 Sep 2004 15:41:14 +0200
Message-ID: <4146316C0000A4CF@ims3a.cp.tin.it>
In-Reply-To: <4146316C0000A4AF@ims3a.cp.tin.it>
From: gerarra@tin.it
To: freebsd-hackers@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable
Subject: RE: FreeBSD Kernel buffer overflow
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 18 Sep 2004 13:41:14 -0000

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
>
>> cat kern_syscalls.diff
>--- kern_syscalls.c     Sat Sep 18 14:37:53 2004
>+++ kern_syscalls2.c    Sat Sep 18 14:37:53 2004
>@@ -73,6 +73,11 @@
>                                sysent[*offset].sy_call !=3D (sy_call_t =
*)lkmressys)
>                return EEXIST;
>
>+#if (__i386__) && (INVARIANTS)
>+       KASSERT(new_sysent->nargs >=3D 0 && new_sysent->nargs <=3D i386_=
SYS_ARGS,
>+               "invalid number of syscalls");
>+#endif
>+
>        *old_sysent =3D sysent[*offset];
>        sysent[*offset] =3D *new_sysent;
>        return 0;

Sorry, a little problem here. There correct text chunk:


> cat kern_syscalls.diff
--- kern_syscalls.c     Sat Sep 18 14:37:53 2004
+++ kern_syscalls2.c    Sat Sep 18 14:37:53 2004
@@ -73,6 +73,11 @@
                                sysent[*offset].sy_call !=3D (sy_call_t *=
)lkmressys)
                return EEXIST;

+#if (__i386__) && (INVARIANTS)
+       KASSERT(new_sysent->sy_nargs >=3D 0 && new_sysent->sy_nargs <=3D =
i386_SYS_ARGS,
+               "invalid number of syscalls");
+#endif
+
        *old_sysent =3D sysent[*offset];
        sysent[*offset] =3D *new_sysent;
        return 0;

(tgz is correct)

rookie