Attachment 39949 Details for Bug 90499

[patch] 2.4 patch for x86-64/ia64

execve-overflow (text/plain), 2.41 KB, created by Andreas Kleen on 2005-06-27 06:52:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2005-06-27 06:52:17 UTC

Size: 2.41 KB

patch

obsolete

>diff -u linux/arch/ia64/ia32/sys_ia32.c-o arch/ia64/ia32/sys_ia32.c
>--- linux/arch/ia64/ia32/sys_ia32.c-o	2005-06-12 16:50:51.000000000 +0200
>+++ linux/arch/ia64/ia32/sys_ia32.c	2005-06-22 18:05:57.000000000 +0200
>@@ -94,7 +94,7 @@
> static DECLARE_MUTEX(ia32_mmap_sem);
> 
> static int
>-nargs (unsigned int arg, char **ap)
>+nargs (unsigned int arg, char **ap, int max)
> {
> 	unsigned int addr;
> 	int n, err;
>@@ -107,6 +107,8 @@
> 		err = get_user(addr, (unsigned int *)A(arg));
> 		if (err)
> 			return err;
>+		if (n > max)
>+			return -E2BIG;
> 		if (ap)
> 			*ap++ = (char *) A(addr);
> 		arg += sizeof(unsigned int);
>@@ -128,10 +130,11 @@
> 	int na, ne, len;
> 	long r;
> 
>-	na = nargs(argv, NULL);
>+	/* Allocates upto 2x MAX_ARG_PAGES */
>+	na = nargs(argv, NULL, (MAX_ARG_PAGES*PAGE_SIZE) / sizeof(char *) - 1);
> 	if (na < 0)
> 		return na;
>-	ne = nargs(envp, NULL);
>+	ne = nargs(envp, NULL, (MAX_ARG_PAGES*PAGE_SIZE) / sizeof(char *) - 1 );
> 	if (ne < 0)
> 		return ne;
> 	len = (na + ne + 2) * sizeof(*av);
>@@ -143,10 +146,10 @@
> 	av[na] = NULL;
> 	ae[ne] = NULL;
> 
>-	r = nargs(argv, av);
>+	r = nargs(argv, av, na);
> 	if (r < 0)
> 		goto out;
>-	r = nargs(envp, ae);
>+	r = nargs(envp, ae, ne);
> 	if (r < 0)
> 		goto out;
> 
>diff -u linux/arch/x86_64/ia32/sys_ia32.c-o arch/x86_64/ia32/sys_ia32.c
>--- linux/arch/x86_64/ia32/sys_ia32.c-o	2005-01-19 15:09:39.000000000 +0100
>+++ linux/arch/x86_64/ia32/sys_ia32.c	2005-06-22 18:07:11.000000000 +0200
>@@ -2200,7 +2200,7 @@
> 	return ret;
> } 
> 
>-static int nargs(u32 src, char **dst) 
>+static int nargs(u32 src, char **dst, int max) 
> { 
> 	int cnt;
> 	u32 val; 
>@@ -2214,7 +2214,7 @@
> 			dst[cnt] = (char *)(u64)val; 
> 		cnt++;
> 		src += 4;
>-		if (cnt >= (MAX_ARG_PAGES * PAGE_SIZE) / sizeof(char *))
>+		if (cnt > max)
> 			return -E2BIG; 
> 	} while(val); 
> 	if (dst)
>@@ -2230,13 +2230,14 @@
> 	int ret;
> 	unsigned sz = 0; 
> 	
>+	/* Can actually allocate 2*MAX_ARG_PAGES */
> 	if (argv) {
>-	na = nargs(argv, NULL); 
>+	na = nargs(argv, NULL, (MAX_ARG_PAGES * PAGE_SIZE)/sizeof(char*) - 1); 
> 	if (na < 0) 
> 		return -EFAULT; 
> 	} 	
> 	if (envp) { 
>-	ne = nargs(envp, NULL); 
>+	ne = nargs(envp, NULL, (MAX_ARG_PAGES * PAGE_SIZE)/sizeof(char*) - 1); 
> 	if (ne < 0) 
> 		return -EFAULT; 
> 	}
>@@ -2252,13 +2253,13 @@
> 	} 
> 	
> 	if (argv) { 
>-	ret = nargs(argv, buf);
>+	ret = nargs(argv, buf, na);
> 	if (ret < 0)
> 		goto free;
> 	}
> 
> 	if (envp) { 
>-	ret = nargs(envp, buf + na); 
>+	ret = nargs(envp, buf + na, ne); 
> 	if (ret < 0)
> 		goto free; 
> 	}

Actions: View | Diff

Attachments on bug 90499: 39007 | 39009 | 39665 | 39949 | 40061