diff options
| author | riastradh <riastradh@NetBSD.org> | 2017-07-28 15:51:35 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2017-07-28 15:51:35 +0000 |
| commit | d53decefd57724ba3a82a982fb2dc652fea5328c (patch) | |
| tree | dbf43effa9205d07a4ae020a299a7b9ee482f22f | |
| parent | 2f40776e8295d7d26db22c5486e3812a3e5f0bf7 (diff) | |
Make sure we move forward over the buffer.
From Ilja Van Sprundel.
| -rw-r--r-- | sys/compat/ibcs2/ibcs2_exec_coff.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/compat/ibcs2/ibcs2_exec_coff.c b/sys/compat/ibcs2/ibcs2_exec_coff.c index 54b1cddb38a..1c5adb36e45 100644 --- a/sys/compat/ibcs2/ibcs2_exec_coff.c +++ b/sys/compat/ibcs2/ibcs2_exec_coff.c @@ -1,4 +1,4 @@ -/* $NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $ */ +/* $NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $ */ /* * Copyright (c) 1994, 1995, 1998 Scott Bartram @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -469,7 +469,8 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *l, struct exec_package *epp, struct coff /* path_index = slhdr->path_index * sizeof(long); */ entry_len = slhdr->entry_len * sizeof(long); - if (entry_len > len || + if (entry_len < sizeof(struct coff_slhdr) || + entry_len > len || strnlen(slhdr->sl_name, entry_len) == entry_len) { free(tbuf, M_TEMP); return ENOEXEC; |
