Date: Wed, 18 Feb 2015 23:34:04 +0000 (UTC) From: John Baldwin <jhb@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r278976 - in head/sys: amd64/amd64 i386/i386 Message-ID: <201502182334.t1INY463076584@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jhb Date: Wed Feb 18 23:34:03 2015 New Revision: 278976 URL: https://svnweb.freebsd.org/changeset/base/278976 Log: Ensure that the supplied data length is large enough to hold the base FPU state to avoid passing a negative length to fpusetregs() / npxsetregs(). Differential Revision: https://reviews.freebsd.org/D1861 Reviewed by: kib, emaste Modified: head/sys/amd64/amd64/ptrace_machdep.c head/sys/i386/i386/ptrace_machdep.c Modified: head/sys/amd64/amd64/ptrace_machdep.c ============================================================================== --- head/sys/amd64/amd64/ptrace_machdep.c Wed Feb 18 23:10:15 2015 (r278975) +++ head/sys/amd64/amd64/ptrace_machdep.c Wed Feb 18 23:34:03 2015 (r278976) @@ -88,7 +88,8 @@ cpu_ptrace_xstate(struct thread *td, int break; case PT_SETXSTATE: - if (data > cpu_max_ext_state_size) { + if (data < sizeof(struct savefpu) || + data > cpu_max_ext_state_size) { error = EINVAL; break; } Modified: head/sys/i386/i386/ptrace_machdep.c ============================================================================== --- head/sys/i386/i386/ptrace_machdep.c Wed Feb 18 23:10:15 2015 (r278975) +++ head/sys/i386/i386/ptrace_machdep.c Wed Feb 18 23:34:03 2015 (r278976) @@ -92,7 +92,8 @@ cpu_ptrace_xstate(struct thread *td, int break; case PT_SETXSTATE: - if (data > cpu_max_ext_state_size) { + if (data < sizeof(union savefpu) || + data > cpu_max_ext_state_size) { error = EINVAL; break; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201502182334.t1INY463076584>