Date: Wed, 7 Jul 2004 11:24:45 GMT From: KOIE Hidetaka <koie@suri.co.jp> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/68765: a little data can be stored beyond EOF. Message-ID: <200407071124.i67BOjAn013074@www.freebsd.org> Resent-Message-ID: <200407071130.i67BUNfq000831@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 68765
>Category: kern
>Synopsis: a little data can be stored beyond EOF.
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Jul 07 11:30:23 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator: KOIE Hidetaka
>Release: FreeBSD-5.2 CURRENT
>Organization:
SURIGIKEN
>Environment:
FreeBSD sakura.suri.co.jp 5.2-CURRENT FreeBSD 5.2-CURRENT #1: Tue Jun 15 11:43:02 JST 2004 koie@sakura.suri.co.jp:/usr/obj/usr/src/sys/SAKURA i38
>Description:
A little data (~pagesize-1) can be stored beyond EOF using mmap.
I have an uneasy feeling someone abuse it.
>How-To-Repeat:
begin 644 hole.c
M(VEN8VQU9&4@/&%S<V5R="YH/@HC:6YC;'5D92`\<W1D:6\N:#X*(VEN8VQU
M9&4@/'-T9&QI8BYH/@HC:6YC;'5D92`\<W1R:6YG+F@^"B-I;F-L=61E(#QF
M8VYT;"YH/@HC:6YC;'5D92`\<WES+W1Y<&5S+F@^"B-I;F-L=61E(#QS>7,O
M;6UA;BYH/@HC:6YC;'5D92`\=6YI<W1D+F@^"@II;G0@4$%'15-)6D4["@HC
M9&5F:6YE($9)3$4@(F5M<'1Y+F1A="(*(V1E9FEN92!314-2151?3T9&(#$P
M,#`*:6YT(&]R9&EN87)Y7W-I>F4["@II;G0*=R@I"GL*("`@(&EN="!R8R`]
M("TQ.PH@("`@:6YT(&9D.PH*("`@("\O('=R:71E(&$@;W)D:6YA<GD@9&%T
M82!N;VUA;&QY"B`@("!I9B`H*&9D(#T@;W!E;BA&24Q%+"!/7U)$5U)\3U]#
M4D5!5'Q/7U1254Y#+"`P-C`P*2D@/"`P*2!["@EP97)R;W(H(F]P96XB*3L*
M"6=O=&\@;W5T.PH@("`@?0H@("`@8VAA<B!B=69;72`](")415-4(CL*("`@
M(&EF("AW<FET92AF9"P@8G5F+"!S:7IE;V8@8G5F*2`A/2!S:7IE;V8@8G5F
M*2!["@EP97)R;W(H(G=R:71E(BD["@EG;W1O(&]U=#L*("`@('T*("`@(&]R
M9&EN87)Y7W-I>F4@/2!L<V5E:RAF9"P@,"P@4T5%2U]#55(I.PH*("`@("\O
M('!U="!A(&AI9&1E;B!D871A(&)E>6]N9"!%3T8*("`@(&-H87(@*F%D9'(@
M/2!M;6%P*#`L(%!!1T5325I%+"!04D]47U)%041\4%)/5%]74DE412P@34%0
M7U-(05)%1"P@9F0L(#`I.PH@("`@:68@*&%D9'(@/3T@34%07T9!24Q%1"D@
M>PH)<&5R<F]R*")M;6%P(BD["@EG;W1O(&]U=#L*("`@('T*("`@(&%S<V5R
M="`H;W)D:6YA<GE?<VEZ92`\(%-%0U)%5%]/1D8I.PH@("`@<W1R8W!Y*&%D
M9'(K4T5#4D547T]&1BP@(E-%0U)%5"(I.PH*("`@("\O(&9I;F%L:7IE"B`@
M("!I9B`H8VQO<V4H9F0I(#P@,"D@>PH)<&5R<F]R*")C;&]S92(I.PH)9V]T
M;R!O=70["B`@("!]"B`@("!I9B`H;75N;6%P*&%D9'(L(%!!1T5325I%*2`\
M(#`I('L*"7!E<G)O<B@B;75N;6%P(BD["@EG;W1O(&]U=#L*("`@('T*("`@
M(')C(#T@,#L*(&]U=#H*("`@(')E='5R;B!R8SL*?0H*:6YT"G(H*0I["B`@
M("!I;G0@<F,@/2`M,3L*("`@(&EN="!F9#L*("`@(&EN="!N.PH@("`@8VAA
M<B!B=69;4$%'15-)6D5=.PH@("`@8VAA<B`J861D<CL*"B`@("`O+R!U<VEN
M9R!R96%D(&YO<FUA;&QY+"!G970@82!O<F1I;F%R>2!D871A+@H@("`@:68@
M*"AF9"`](&]P96XH1DE,12P@3U]21$].3%DI*2`\(#`I('L*"7!E<G)O<B@B
M;W!E;B(I.PH)9V]T;R!O=70["B`@("!]"B`@("!I9B`H*&X@/2!R96%D*&9D
M+"!B=68L('-I>F5O9B!B=68I*2`\(#`I('L*"7!E<G)O<B@B<F5A9"(I.PH)
M9V]T;R!O=70["B`@("!]"B`@("!P<FEN=&8H(G)E860@;CTE9"!B=68]/"5S
M/EQN(BP@;BP@8G5F*3L*"B`@("`O+R!U<VEN9R!M;6%P+"!E>'1R86-T(&$@
M:&ED9&5N(&1A=&$N"B`@("!A9&1R(#T@;6UA<"@P+"!004=%4TE:12P@4%)/
M5%]214%$+"!-05!?4%))5D%412P@9F0L(#`I.PH@("`@:68@*&%D9'(@/3T@
M34%07T9!24Q%1"D@>PH)<&5R<F]R*")M;6%P(BD["@EG;W1O(&]U=#L*("`@
M('T*("`@('!R:6YT9B@B4T5#4D547T]&1CT\)7,^7&XB+"!A9&1R*U-%0U)%
M5%]/1D8I.PH*("`@("\O(&9I;F%L:7IE"B`@("!I9B`H8VQO<V4H9F0I(#P@
M,"D@>PH)<&5R<F]R*")C;&]S92(I.PH)9V]T;R!O=70["B`@("!]"B`@("!I
M9B`H;75N;6%P*&%D9'(L(%!!1T5325I%*2`\(#`I('L*"7!E<G)O<B@B;75N
M;6%P(BD["@EG;W1O(&]U=#L*("`@('T*("`@(')C(#T@,#L*(&]U=#H*("`@
M(')E='5R;B!R8SL*?0H*:6YT"FUA:6XH*0I["B`@("!004=%4TE:12`]('-Y
M<V-O;F8H7U-#7U!!1T5325I%*3L*("`@(&EF("AW*"D@/"`P*0H)9V]T;R!O
M=70["B`@("!I9B`H<B@I(#P@,"D*"6=O=&\@;W5T.PHC:68@,0H@("`@+RH@
M97)A<V4@*B\*("`@('1R=6YC871E*$9)3$4L(&]R9&EN87)Y7W-I>F4K,2D[
M"B`@("!T<G5N8V%T92A&24Q%+"!O<F1I;F%R>5]S:7IE*3L*(V5N9&EF"B`@
M("!I9B`H<B@I(#P@,"D*"6=O=&\@;W5T.PH@;W5T.@H@("`@97AI="@P*3L*
"?0H`
`
end
>Fix:
Sorry, I dont now.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200407071124.i67BOjAn013074>