DragonFlyBSD Kernel Audit
DF-2718 / fix.diff
← back to finding ↓ download raw
@@ -1833,9 +1833,14 @@
 	pathloc = pinterpreter->p_offset;
 	endbyte = pathloc + pathsz;
 
+	if (pathsz < 2)			/* need at least one char plus NUL */
+		return (result_failure);
+
 	limited_to_first_page = pathloc < PAGE_SIZE && endbyte < PAGE_SIZE;
 	if (limited_to_first_page) {
 	        bcopy(imgp->image_header + pathloc, data, pathsz);
+	        if (data[pathsz - 1] != '\0')	/* unterminated string */
+		        return (result_failure);
 	        return (result_success);
 	}
 
@@ -1859,6 +1864,8 @@
 		bcopy(page + firstloc, data, pathsz);
 
 	exec_unmap_page(lwb);
+	if (data[pathsz - 1] != '\0')		/* unterminated string */
+		return (result_failure);
 	return (result_success);
 }