upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-11 01:30:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Revised SA-16:15. The initial patch didn't cover all possible overflows

Browse source 
based on passing incorrect parameters to sysarch(2). [1]

Fix unchecked array reference in the VGA device emulation code. [2]

Security:	SA-16:15 [1]
Security:       SA-16:32 [2]
Approved by:	so
This commit is contained in:
glebius 2016-10-25 17:11:20 +00:00 committed by Franco Fichtner
parent 80553d1e58
commit c0db4668d7
4 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
UPDATING
View file

@ -16,6 +16,12 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to
the tip of head, and then rebuild without this option. The bootstrap process
from older version of current across the gcc/clang cutover is a bit fragile.
20161025 p2 FreeBSD-SA-16:15.sysarch [revised]
FreeBSD-SA-16:32.bhyve
Fix incorrect argument validation in sysarch(2). [SA-16:15]
Fix access to host memory from guest in bhyve(8). [SA-16:32]
20160928:
11.0-RELEASE.

5
sys/amd64/amd64/sys_machdep.c
View file

@ -608,6 +608,8 @@ amd64_set_ldt(td, uap, descs)
largest_ld = uap->start + uap->num;
if (largest_ld > max_ldt_segment)
largest_ld = max_ldt_segment;
if (largest_ld < uap->start)
return (EINVAL);
i = largest_ld - uap->start;
mtx_lock(&dt_lock);
bzero(&((struct user_segment_descriptor *)(pldt->ldt_base))
@ -620,7 +622,8 @@ amd64_set_ldt(td, uap, descs)
/* verify range of descriptors to modify */
largest_ld = uap->start + uap->num;
if (uap->start >= max_ldt_segment ||
largest_ld > max_ldt_segment)
largest_ld > max_ldt_segment ||
largest_ld < uap->start)
return (EINVAL);
}

2
sys/conf/newvers.sh
View file

@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="11.0"
BRANCH="RELEASE-p1"
BRANCH="RELEASE-p2"
if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi

8
usr.sbin/bhyve/vga.c
View file

@ -161,10 +161,10 @@ struct vga_softc {
*/
struct {
uint8_t dac_state;
int dac_rd_index;
int dac_rd_subindex;
int dac_wr_index;
int dac_wr_subindex;
uint8_t dac_rd_index;
uint8_t dac_rd_subindex;
uint8_t dac_wr_index;
uint8_t dac_wr_subindex;
uint8_t dac_palette[3 * 256];
uint32_t dac_palette_rgb[256];
} vga_dac;