https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=240573
Bug ID: 240573
Summary: sysctl() does not return ENOMEM but silently truncate
return data
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: b...@freebsd.org
Reporter: rozhuk...@gmail.com
int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_FILEDESC, getpid() };
if (0 != sysctl(mib, 4, NULL, &buf_size, NULL, 0))
return (errno);
buf = malloc(buf, buf_size);
newfd = open("/dev/null", O_RDONLY); /* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! */
if (0 != sysctl(mib, 4, buf, &buf_size, NULL, 0)) {
if (ENOMEM != errno) {
free(buf)
return (errno);
}
}
This code should fail, but it fill buf with struct kinfo_file, and there is no
newfd.
No fail, no error code set, silent data truncation.
Probably sys/kern/kern_descrip.c: export_kinfo_to_sb()
...
if (efbuf->remainder < kif->kf_structsize) {
/* Terminate export. */
efbuf->remainder = 0;
return (0);
}
...
should return here ENOMEM!?
I see hack to avoid missing fd for that in
lib/libutil/kinfo_getfile.c: kinfo_getfile():
...
len = len * 4 / 3;
...
Same for kern.ipc.posix_shm_list.
sys/kern/uipc_shm.c: sysctl_posix_shm_list()
if (req->oldptr != NULL &&
kif.kf_structsize + curlen > req->oldlen)
break;
error = ENOMEM; - before break missed.
hack:
usr.bin/posixshmcontrol/posixshmcontrol.c: list_shm()
sys/kern/kern_proc.c: kern_proc_vmmap_out()
...
/* Halt filling and truncate rather than exceeding maxlen */
if (maxlen != -1 && maxlen < kve->kve_structsize) {
error = 0;
vm_map_lock_read(map);
break;
...
error = ENOMEM;?
And probably other places where exist buf size check and exit from loop before
call sbuf_bcat().
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
