Attachment 39665 Details for Bug 90499

[patch] tested and working patch (on x86-64)

execve-overflow-3 (text/plain), 2.60 KB, created by Andreas Kleen on 2005-06-22 15:20:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2005-06-22 15:20:05 UTC

Size: 2.60 KB

patch

obsolete

>diff -u linux-2.6.5/arch/ia64/ia32/sys_ia32.c-o linux-2.6.5/arch/ia64/ia32/sys_ia32.c
>--- linux-2.6.5/arch/ia64/ia32/sys_ia32.c-o	2005-06-14 16:28:01.000000000 +0200
>+++ linux-2.6.5/arch/ia64/ia32/sys_ia32.c	2005-06-22 17:11:32.000000000 +0200
>@@ -95,7 +95,7 @@
> static DECLARE_MUTEX(ia32_mmap_sem);
> 
> static int
>-nargs (unsigned int arg, char **ap)
>+nargs (unsigned int arg, char **ap, int max)
> {
> 	unsigned int addr;
> 	int n, err;
>@@ -108,6 +108,8 @@
> 		err = get_user(addr, (unsigned int *)A(arg));
> 		if (err)
> 			return err;
>+		if (n > max)
>+			return -E2BIG;
> 		if (ap)
> 			*ap++ = (char *) A(addr);
> 		arg += sizeof(unsigned int);
>@@ -125,10 +127,11 @@
> 	int na, ne, len;
> 	long r;
> 
>-	na = nargs(argv, NULL);
>+	/* Allocates upto 2x MAX_ARG_PAGES */
>+	na = nargs(argv, NULL, (MAX_ARG_PAGES*PAGE_SIZE) / sizeof(char *) - 1);
> 	if (na < 0)
> 		return na;
>-	ne = nargs(envp, NULL);
>+	ne = nargs(envp, NULL, (MAX_ARG_PAGES*PAGE_SIZE) / sizeof(char *) - 1 );
> 	if (ne < 0)
> 		return ne;
> 	len = (na + ne + 2) * sizeof(*av);
>@@ -140,10 +143,10 @@
> 	av[na] = NULL;
> 	ae[ne] = NULL;
> 
>-	r = nargs(argv, av);
>+	r = nargs(argv, av, na);
> 	if (r < 0)
> 		goto out;
>-	r = nargs(envp, ae);
>+	r = nargs(envp, ae, ne);
> 	if (r < 0)
> 		goto out;
> 
>diff -u linux-2.6.5/arch/x86_64/ia32/sys_ia32.c-o linux-2.6.5/arch/x86_64/ia32/sys_ia32.c
>--- linux-2.6.5/arch/x86_64/ia32/sys_ia32.c-o	2005-06-14 16:28:05.000000000 +0200
>+++ linux-2.6.5/arch/x86_64/ia32/sys_ia32.c	2005-06-22 17:11:41.000000000 +0200
>@@ -1218,7 +1218,7 @@
> 	return ret;
> } 
> 
>-static int nargs(u32 src, char **dst) 
>+static int nargs(u32 src, char **dst, unsigned max) 
> { 
> 	int cnt;
> 	u32 val; 
>@@ -1228,12 +1228,12 @@
> 		int ret = get_user(val, (__u32 *)(u64)src); 
> 		if (ret)
> 			return ret;
>+		if (cnt > max)
>+			return -E2BIG; 
> 		if (dst)
> 			dst[cnt] = (char *)(u64)val; 
> 		cnt++;
> 		src += 4; 	
>-		if (cnt >= (MAX_ARG_PAGES*PAGE_SIZE)/sizeof(void*))
>-			return -E2BIG; 
> 	} while(val); 
> 	if (dst)
> 		dst[cnt-1] = 0; 
>@@ -1248,13 +1248,14 @@
> 	int ret;
> 	unsigned sz = 0; 
> 
>+	/* RED-PEN We actually allocate 2 * MAX_ARG_PAGES max */
> 	if (argv) {
>-	na = nargs(argv, NULL); 
>+	na = nargs(argv, NULL, (MAX_ARG_PAGES*PAGE_SIZE)/sizeof(void*) - 1); 
> 	if (na < 0) 
> 		return -EFAULT; 
> 	} 	
> 	if (envp) { 
>-	ne = nargs(envp, NULL); 
>+	ne = nargs(envp, NULL, (MAX_ARG_PAGES*PAGE_SIZE)/sizeof(void*) - 1); 
> 	if (ne < 0) 
> 		return -EFAULT; 
> 	}
>@@ -1270,13 +1271,13 @@
> 	} 
> 	
> 	if (argv) { 
>-	ret = nargs(argv, buf);
>+	ret = nargs(argv, buf, na);
> 	if (ret < 0)
> 		goto free;
> 	}
> 
> 	if (envp) { 
>-	ret = nargs(envp, buf + na); 
>+	ret = nargs(envp, buf + na, ne); 
> 	if (ret < 0)
> 		goto free; 
> 	}

Actions: View | Diff

Attachments on bug 90499: 39007 | 39009 | 39665 | 39949 | 40061