Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 03 Sep 2018 11:05:34 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 231116] Out of bounds memory access in blist_create()
Message-ID:  <bug-231116-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D231116

            Bug ID: 231116
           Summary: Out of bounds memory access in blist_create()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: sebastian.huber@embedded-brains.de

The memory allocation size in blist_create() is insufficient.  For example
blist_create(256, 1) calculates nodes =3D=3D 5 which is used to for the

bl =3D malloc(offsetof(struct blist, bl_root[nodes + 1]), M_SWAP, flags |
            M_ZERO);

and then later there is an access here

bl->bl_root[i_+_skip].bm_bighint_=3D_(daddr_t)-1;

with i =3D=3D 4 and skip =3D=3D 1;

--=20
You are receiving this mail because:
You are the assignee for the bug.=

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-231116-227>