35 lines
876 B
Diff
35 lines
876 B
Diff
--- sys/kern/imgact_elf.c.orig
|
|
+++ sys/kern/imgact_elf.c
|
|
@@ -839,7 +839,8 @@
|
|
break;
|
|
case PT_INTERP:
|
|
/* Path to interpreter */
|
|
- if (phdr[i].p_filesz > MAXPATHLEN) {
|
|
+ if (phdr[i].p_filesz < 2 ||
|
|
+ phdr[i].p_filesz > MAXPATHLEN) {
|
|
uprintf("Invalid PT_INTERP\n");
|
|
error = ENOEXEC;
|
|
goto ret;
|
|
@@ -870,6 +871,11 @@
|
|
} else {
|
|
interp = __DECONST(char *, imgp->image_header) +
|
|
phdr[i].p_offset;
|
|
+ if (interp[interp_name_len - 1] != '\0') {
|
|
+ uprintf("Invalid PT_INTERP\n");
|
|
+ error = ENOEXEC;
|
|
+ goto ret;
|
|
+ }
|
|
}
|
|
break;
|
|
case PT_GNU_STACK:
|
|
--- sys/kern/vfs_vnops.c.orig
|
|
+++ sys/kern/vfs_vnops.c
|
|
@@ -528,6 +528,8 @@
|
|
struct vn_io_fault_args args;
|
|
int error, lock_flags;
|
|
|
|
+ if (offset < 0 && vp->v_type != VCHR)
|
|
+ return (EINVAL);
|
|
auio.uio_iov = &aiov;
|
|
auio.uio_iovcnt = 1;
|
|
aiov.iov_base = base;
|