DragonFlyBSD Kernel Audit
DF-0150 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/subr_module.c b/sys/kern/subr_module.c
--- a/sys/kern/subr_module.c
+++ b/sys/kern/subr_module.c
@@ -66,7 +66,16 @@
 	 * ought to strip the path names
 	 */
 	if (hdr[0] == MODINFO_NAME) {
+	    size_t namelen = hdr[1];
 	    scanname = curp + sizeof(u_int32_t) * 2;
+	    /* Ensure the name field is NUL-terminated within its declared
+	     * length before trusting strlen/strcmp on it. */
+	    if (hdr[1] == 0 || scanname[namelen - 1] != 0) {
+		next = sizeof(u_int32_t) * 2 + hdr[1];
+		next = roundup(next, sizeof(u_long));
+		curp += next;
+		continue;
+	    }
 	    i = strlen(scanname);
 	    while (i > 0 && scanname[i-1] != '/')
 		--i;