Date: Tue, 9 Aug 2022 19:58:54 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 0aa6d8576d9e - releng/12.3 - elf_note_prpsinfo: handle more failures from proc_getargv() Message-ID: <202208091958.279JwsA7021442@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch releng/12.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=0aa6d8576d9e7e4463323b82b7dac178f56237e0 commit 0aa6d8576d9e7e4463323b82b7dac178f56237e0 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2022-06-03 08:21:23 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2022-08-09 19:57:10 +0000 elf_note_prpsinfo: handle more failures from proc_getargv() Resulting sbuf_len() from proc_getargv() might return 0 if user mangled ps_strings enough. Also, sbuf_len() API contract is to return -1 if the buffer overflowed. The later should not occur because get_ps_strings() checks for catenated length, but check for this subtle detail explicitly as well to be more resilent. The end result is that p_comm is used in this situations. Approved by: so Security: FreeBSD-SA-22:09.elf Reported by: Josef 'Jeff' Sipek <jeffpc@josefsipek.net> Reviewed by: delphij, markj admbugs: 988 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35391 (cherry picked from commit 00d17cf342cd9f4f8fd1dcd79c8caec359145532) (cherry picked from commit 2170511d491b65a07dc4416ecda2fbb37349aa10) --- sys/kern/imgact_elf.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index 416de09630ae..b301e9a499ec 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -2149,13 +2149,16 @@ __elfN(note_prpsinfo)(void *arg, struct sbuf *sb, size_t *sizep) sizeof(psinfo->pr_psargs), SBUF_FIXEDLEN); error = proc_getargv(curthread, p, &sbarg); PRELE(p); - if (sbuf_finish(&sbarg) == 0) - len = sbuf_len(&sbarg) - 1; - else + if (sbuf_finish(&sbarg) == 0) { + len = sbuf_len(&sbarg); + if (len > 0) + len--; + } else { len = sizeof(psinfo->pr_psargs) - 1; + } sbuf_delete(&sbarg); } - if (error || len == 0) + if (error != 0 || len == 0 || (ssize_t)len == -1) strlcpy(psinfo->pr_psargs, p->p_comm, sizeof(psinfo->pr_psargs)); else {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202208091958.279JwsA7021442>