Author: jh
Date: Wed Jul 13 06:20:00 2011
New Revision: 223977
URL: http://svn.freebsd.org/changeset/base/223977
Log:
MFC r222216:
In init_dynamic_kenv(), ignore environment strings exceeding the
KENV_MNAMELEN + 1 + KENV_MVALLEN + 1 length limit to avoid buffer
overflow in getenv(). Currenly loader(8) doesn't limit the length of
environment strings.
PR: kern/132104
Modified:
stable/8/sys/kern/kern_environment.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
Modified: stable/8/sys/kern/kern_environment.c
==============================================================================
--- stable/8/sys/kern/kern_environment.c Wed Jul 13 05:56:51 2011
(r223976)
+++ stable/8/sys/kern/kern_environment.c Wed Jul 13 06:20:00 2011
(r223977)
@@ -215,13 +215,19 @@ static void
init_dynamic_kenv(void *data __unused)
{
char *cp;
- int len, i;
+ size_t len;
+ int i;
kenvp = malloc((KENV_SIZE + 1) * sizeof(char *), M_KENV,
M_WAITOK | M_ZERO);
i = 0;
for (cp = kern_envp; cp != NULL; cp = kernenv_next(cp)) {
len = strlen(cp) + 1;
+ if (len > KENV_MNAMELEN + 1 + KENV_MVALLEN + 1) {
+ printf("WARNING: too long kenv string, ignoring %s\n",
+ cp);
+ continue;
+ }
if (i < KENV_SIZE) {
kenvp[i] = malloc(len, M_KENV, M_WAITOK);
strcpy(kenvp[i++], cp);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
