[Bug 207629] Integer overflow in sysctl_kern_proc_args
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 23 May 2023 20:26:15 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207629
Mark Johnston <markj@FreeBSD.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
CC| |markj@FreeBSD.org
Status|New |Closed
--- Comment #2 from Mark Johnston <markj@FreeBSD.org> ---
Sorry that this didn't get attention when it was submitted. I think this has
since been fixed by commit 712dda7fb0b83, though it's possible that something
else mitigated it before that.
> There is another possibility though; if `req->newlen` is `-12`, the allocation will be 0, and the 2 writes in `pargs_alloc` will be out of bounds.
An allocation length of zero will return a chunk of 16 bytes, so I don't think
this could have resulted in an out-of-bounds write.
--
You are receiving this mail because:
You are the assignee for the bug.