summaryrefslogtreecommitdiff
path: root/sys/compat
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2017-07-28 15:51:35 +0000
committerriastradh <riastradh@NetBSD.org>2017-07-28 15:51:35 +0000
commitd53decefd57724ba3a82a982fb2dc652fea5328c (patch)
treedbf43effa9205d07a4ae020a299a7b9ee482f22f /sys/compat
parent2f40776e8295d7d26db22c5486e3812a3e5f0bf7 (diff)
Make sure we move forward over the buffer.
From Ilja Van Sprundel.
Diffstat (limited to 'sys/compat')
-rw-r--r--sys/compat/ibcs2/ibcs2_exec_coff.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/compat/ibcs2/ibcs2_exec_coff.c b/sys/compat/ibcs2/ibcs2_exec_coff.c
index 54b1cddb38a..1c5adb36e45 100644
--- a/sys/compat/ibcs2/ibcs2_exec_coff.c
+++ b/sys/compat/ibcs2/ibcs2_exec_coff.c
@@ -1,4 +1,4 @@
-/* $NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $ */
+/* $NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $ */
/*
* Copyright (c) 1994, 1995, 1998 Scott Bartram
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.28 2017/07/28 15:50:04 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ibcs2_exec_coff.c,v 1.29 2017/07/28 15:51:35 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -469,7 +469,8 @@ exec_ibcs2_coff_prep_zmagic(struct lwp *l, struct exec_package *epp, struct coff
/* path_index = slhdr->path_index * sizeof(long); */
entry_len = slhdr->entry_len * sizeof(long);
- if (entry_len > len ||
+ if (entry_len < sizeof(struct coff_slhdr) ||
+ entry_len > len ||
strnlen(slhdr->sl_name, entry_len) == entry_len) {
free(tbuf, M_TEMP);
return ENOEXEC;