⬢ DragonFlyBSD Kernel Audit
DF-2247 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
--- a/sys/sys/iconv.h
+++ b/sys/sys/iconv.h
@@ -127,6 +127,7 @@
 	void *		cp_data;
 	struct iconv_converter_class * cp_dcp;
 	struct iconv_cspair *cp_base;
+	int		cp_datalen;	/* size of cp_data, if any */
 	TAILQ_ENTRY(iconv_cspair)	cp_link;
 };
 
--- a/sys/libiconv/iconv.c
+++ b/sys/libiconv/iconv.c
@@ -423,6 +423,7 @@
 		lockmgr(&iconv_lock, LK_RELEASE);
 		return error;
 	}
+	csp->cp_datalen = din.ia_datalen;
 	if (din.ia_datalen) {
 		csp->cp_data = kmalloc(din.ia_datalen, M_ICONVDATA, M_WAITOK);
 		error = copyin(din.ia_data, csp->cp_data, din.ia_datalen);
--- a/sys/libiconv/iconv_xlat.c
+++ b/sys/libiconv/iconv_xlat.c
@@ -57,6 +57,10 @@
 {
 	struct iconv_xlat *dp;
 
+	if (csp->cp_datalen != 256) {
+		/* d_table is indexed 0..255 via (u_char)*src */
+		return (EINVAL);
+	}
 	dp = (struct iconv_xlat *)kobj_create((struct kobj_class*)dcp, M_ICONV, M_WAITOK);
 	dp->d_table = csp->cp_data;
 	dp->d_csp = csp;