Date: Fri, 15 Feb 2002 11:45:01 -0800 (PST) From: James Gritton <jamie@gritton.org> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/34979: __semctl verifies semid against wrong value Message-ID: <200202151945.g1FJj1E24085@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 34979 >Category: kern >Synopsis: __semctl verifies semid against wrong value >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Feb 15 11:50:00 PST 2002 >Closed-Date: >Last-Modified: >Originator: James Gritton >Release: 4.5 >Organization: Verio >Environment: FreeBSD flail.e.gritton.org 4.5-RELEASE FreeBSD 4.5-RELEASE #0: Thu Feb 7 11:16:16 MST 2002 gritton@flail.e.gritton.org:/usr/src/sys/compile/FLAIL i386 >Description: __semctl in sysv_sem.c does a boundary check on the semid against seminfo.semmsl. But that's the limit on semaphores per ID, not max IDs. The proper limit to check is seminfo.semmni. >How-To-Repeat: I haven't seen any actual panics or anything from this (though it's remotely possible). >Fix: --- sysv_sem.c.orig Mon Sep 10 05:37:34 2001 +++ sysv_sem.c Fri Feb 15 12:42:39 2002 @@ -415,7 +415,7 @@ return (ENOSYS); semid = IPCID_TO_IX(semid); - if (semid < 0 || semid >= seminfo.semmsl) + if (semid < 0 || semid >= seminfo.semmni) return(EINVAL); semaptr = &sema[semid]; >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200202151945.g1FJj1E24085>