Re: Fwd: Any user can panic OpenBSD machine

[dag-erli () IFI UIO NO (Dag-Erling Coidan Smørgrav)]

"Todd C. Miller" <Todd.Miller () courtesan com> writes:
> In message <xzphg0357ze.fsf () hrotti ifi uio no>
>       so spake  (dag-erli):
>
> > /sys/kern/sys_generic.c:
> >                 if (uap->iovcnt > UIO_MAXIOV)
> >                         return (EINVAL);
>
> We are talking about uio_resid not uio_iovcnt.

*thwap* my mistake. The relevant piece of code is:

/sys/kern/sys_generic.c:
        auio.uio_resid = 0;
        for (i = 0; i < uap->iovcnt; i++) {
                auio.uio_resid += iov->iov_len;
                if (auio.uio_resid < 0) {
                        error = EINVAL;
                        goto done;
                }
                iov++;
        }

and since, as someone pointed out, iov->iov_len is a size_t, it
doesn't make sense to check for negative values of auio.uio_resid. The
problem arises from auio.uio_resid being an int rather than a size_t.

DES (open mouth, insert foot, echo internationally)
--
Dag-Erling Smørgrav - dag-erli () ifi uio no