From owner-freebsd-bugs@FreeBSD.ORG Mon Jul 25 05:30:11 2005 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B3A1416A41F for ; Mon, 25 Jul 2005 05:30:11 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6A5DD43D48 for ; Mon, 25 Jul 2005 05:30:10 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id j6P5UA25065617 for ; Mon, 25 Jul 2005 05:30:10 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id j6P5UAFF065608; Mon, 25 Jul 2005 05:30:10 GMT (envelope-from gnats) Resent-Date: Mon, 25 Jul 2005 05:30:10 GMT Resent-Message-Id: <200507250530.j6P5UAFF065608@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, "Anish Mistry" Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 50DEC16A41F for ; Mon, 25 Jul 2005 05:26:38 +0000 (GMT) (envelope-from amistry@am-productions.biz) Received: from smtp1.fuse.net (mail-out1.fuse.net [216.68.8.174]) by mx1.FreeBSD.org (Postfix) with ESMTP id B777F43D48 for ; Mon, 25 Jul 2005 05:26:37 +0000 (GMT) (envelope-from amistry@am-productions.biz) Received: from gx4.fuse.net ([66.42.172.210]) by smtp1.fuse.net (InterMail vM.6.01.04.04 201-2131-118-104-20050224) with ESMTP id <20050725052636.DATR4201.smtp1.fuse.net@gx4.fuse.net> for ; Mon, 25 Jul 2005 01:26:36 -0400 Received: from bigguy.am-productions.biz ([66.42.172.210]) by gx4.fuse.net (InterMail vG.1.02.00.02 201-2136-104-102-20041210) with ESMTP id <20050725052636.BYEY12227.gx4.fuse.net@bigguy.am-productions.biz> for ; Mon, 25 Jul 2005 01:26:36 -0400 Message-Id: <1122269180.0@bigguy.am-productions.biz> Date: Mon, 25 Jul 2005 01:26:20 -0400 From: "Anish Mistry" To: "FreeBSD gnats submit" X-Send-Pr-Version: gtk-send-pr 0.4.4 Cc: Harry Coin Subject: kern/84033: kenvp table size not checked X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jul 2005 05:30:11 -0000 >Number: 84033 >Category: kern >Synopsis: kenvp table size not checked >Confidential: no >Severity: critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jul 25 05:30:09 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Anish Mistry >Release: FreeBSD 7.0-CURRENT i386 >Organization: AM Productions >Environment: FreeBSD littleguy.am-productions.biz 7.0-CURRENT FreeBSD 7.0-CURRENT #0: Sat Jul 23 17:27:32 EDT 2005 amistry@littleguy.am-productions.biz:/usr/obj/usr/src/sys/LITTLEGUY i386 >Description: In kern_environment.c the kernel enviroment table size isn't checked and you can overflow the KENV_SIZE table size. >How-To-Repeat: Run as root the test script with a large value range, which cause the system to panic. eg. ./test.sh 1 5555 The patch fixes the problem and limits the size of the table to KENV_SIZE-1 entries. >Fix: --- kern_environment.c.patch begins here --- --- /sys/kern/kern_environment.c.orig Sat Jul 23 16:43:32 2005 +++ /sys/kern/kern_environment.c Sat Jul 23 16:46:28 2005 @@ -349,6 +349,11 @@ /* We add the option if it wasn't found */ for (i = 0; (cp = kenvp[i]) != NULL; i++) ; + if (i >= KENV_SIZE-1) { + sx_xunlock(&kenv_lock); + free(buf,M_KENV); + return (-1); + } kenvp[i] = buf; kenvp[i + 1] = NULL; sx_xunlock(&kenv_lock); --- kern_environment.c.patch ends here --- --- test.sh begins here --- #!/bin/sh # # START=$1 END=$2 COUNT=$START while [ "$COUNT" -le "$END" ] do kenv $COUNT="$COUNT" COUNT=`expr $COUNT + 1` done exit 0 --- test.sh ends here --- >Release-Note: >Audit-Trail: >Unformatted: