FreeBSD Bugzilla – Attachment 176773 Details for
Bug 214300
Integer truncation issues lead to out-of-bounds kernel reads and panics in clock_settime().
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Proposed workaround
1.patch (text/plain), 1.35 KB, created by
Konstantin Belousov
on 2016-11-08 12:08:13 UTC
(
hide
)
Description:
Proposed workaround
Filename:
MIME Type:
Creator:
Konstantin Belousov
Created:
2016-11-08 12:08:13 UTC
Size:
1.35 KB
patch
obsolete
>diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c >index fbc42c9..d8cb590 100644 >--- a/sys/kern/kern_time.c >+++ b/sys/kern/kern_time.c >@@ -387,6 +387,11 @@ sys_clock_settime(struct thread *td, struct clock_settime_args *uap) > return (kern_clock_settime(td, uap->clock_id, &ats)); > } > >+static int allow_insane_settime = 0; >+SYSCTL_INT(_debug, OID_AUTO, allow_insane_settime, CTLFLAG_RWTUN, >+ &allow_insane_settime, 0, >+ "do not perform possibly restrictive checks on settime(2) args"); >+ > int > kern_clock_settime(struct thread *td, clockid_t clock_id, struct timespec *ats) > { >@@ -400,6 +405,8 @@ kern_clock_settime(struct thread *td, clockid_t clock_id, struct timespec *ats) > if (ats->tv_nsec < 0 || ats->tv_nsec >= 1000000000 || > ats->tv_sec < 0) > return (EINVAL); >+ if (!allow_insane_settime && ats->tv_sec > 9999ULL * 366 * 24 * 3600) >+ return (EINVAL); > /* XXX Don't convert nsec->usec and back */ > TIMESPEC_TO_TIMEVAL(&atv, ats); > error = settime(td, &atv); >diff --git a/sys/kern/subr_clock.c b/sys/kern/subr_clock.c >index dea3e579..95f8697 100644 >--- a/sys/kern/subr_clock.c >+++ b/sys/kern/subr_clock.c >@@ -178,7 +178,8 @@ clock_ct_to_ts(struct clocktime *ct, struct timespec *ts) > void > clock_ts_to_ct(struct timespec *ts, struct clocktime *ct) > { >- int i, year, days; >+ int i; >+ long year, days; > time_t rsec; /* remainder seconds */ > time_t secs; >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 214300
:
176751
| 176773