Date: Thu, 31 Mar 2016 17:00:48 +0000 (UTC) From: Edward Tomasz Napierala <trasz@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r297458 - head/sys/kern Message-ID: <201603311700.u2VH0m8p069186@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: trasz Date: Thu Mar 31 17:00:47 2016 New Revision: 297458 URL: https://svnweb.freebsd.org/changeset/base/297458 Log: Fix overflows, making it impossible to add negative amounts using rctl(8). MFC after: 1 month Sponsored by: The FreeBSD Foundation Modified: head/sys/kern/kern_rctl.c Modified: head/sys/kern/kern_rctl.c ============================================================================== --- head/sys/kern/kern_rctl.c Thu Mar 31 16:44:32 2016 (r297457) +++ head/sys/kern/kern_rctl.c Thu Mar 31 17:00:47 2016 (r297458) @@ -642,6 +642,9 @@ str2int64(const char *str, int64_t *valu if ((size_t)(end - str) != strlen(str)) return (EINVAL); + if (*value < 0) + return (ERANGE); + return (0); } @@ -1008,8 +1011,13 @@ rctl_string_to_rule(char *rulestr, struc error = str2int64(amountstr, &rule->rr_amount); if (error != 0) goto out; - if (RACCT_IS_IN_MILLIONS(rule->rr_resource)) + if (RACCT_IS_IN_MILLIONS(rule->rr_resource)) { + if (rule->rr_amount > INT64_MAX / 1000000) { + error = ERANGE; + goto out; + } rule->rr_amount *= 1000000; + } } if (perstr == NULL || perstr[0] == '\0')
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201603311700.u2VH0m8p069186>