lkml.org 
[lkml]   [2001]   [Oct]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [CHECKER] Probable Security Errors in 2.4.12-ac3
Date
From: "Ken Ashcraft" <kash@stanford.edu>
> [BUG] minor, loops on len
> /home/kash/linux/2.4.12/ipc/msg.c:788:sys_msgrcv: ERROR:RANGE:756:788: Using user length "msgsz" as argument to "store_msg"
[type=GLOBAL] [state = need_ub] set by 'user-originated parameter':756 [distance=81]
>
> ss_wakeup(&msq->q_senders,0);
> msg_unlock(msqid);
> out_success:
> msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
> if (put_user (msg->m_type, &msgp->mtype) ||
> Error --->
> store_msg(msgp->mtext, msg, msgsz)) {
> msgsz = -EFAULT;
> }
> free_msg(msg);

That's not a bug:
* msgsz is limited to msg->m_ts (2 lines above store_msg)
* msg->m_ts is set by sys_msgsnd to msgsz, and that function rejects messages longer than msg_ctlmax.

--
Manfred

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:08    [W:1.535 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site