Date: Sat, 02 Jan 2016 19:53:55 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 205806] [patch] bsdinstall(8): partedit can hang/crash on read/lseek/malloc failures Message-ID: <bug-205806-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D205806 Bug ID: 205806 Summary: [patch] bsdinstall(8): partedit can hang/crash on read/lseek/malloc failures Product: Base System Version: 10.2-STABLE Hardware: amd64 OS: Any Status: New Keywords: patch Severity: Affects Only Me Priority: --- Component: bin Assignee: freebsd-bugs@FreeBSD.org Reporter: will@worrbase.com CC: freebsd-amd64@FreeBSD.org Keywords: patch CC: freebsd-amd64@FreeBSD.org Created attachment 164966 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D164966&action= =3Dedit malloc + read in a loop -> mmap The current code for reading in the bootcode from a file has a few problems. https://svnweb.freebsd.org/base/head/usr.sbin/bsdinstall/partedit/gpart_ops= .c?revision=3D285679&view=3Dmarkup#l408 408: if lseek(2) fails, bootsize underflows to SIZE_T_MAX, making the resul= ting allocation dangerous 409: if malloc(3) fails, we end up with a null pointer deref later 413: if read(2) fails, the installer will hang trying to read(2) boot loader code I've replaced this with a call to mmap(2), which will give us what we want,= and also contains more error-handling if something goes wrong. Tested on FreeBSD 10.2-STABLE on amd64. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-205806-8>