⬢ DragonFlyBSD Kernel Audit
DF-2783 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
--- a/sys/kern/sysv_sem.c
+++ b/sys/kern/sysv_sem.c
@@ -428,7 +428,9 @@
 			break;
 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
 			break;
-		eval = copyout(&semaptr->ds, real_arg.buf,
+		sbuf = semaptr->ds;
+		sbuf.sem_base = NULL;	/* do not disclose kernel pointers */
+		eval = copyout(&sbuf, real_arg.buf,
 			       sizeof(struct semid_ds));
 		break;
 	case SEM_STAT:
@@ -447,7 +449,9 @@
 			break;
 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
 			break;
-		eval = copyout(&semaptr->ds, real_arg.buf,
+		sbuf = semaptr->ds;
+		sbuf.sem_base = NULL;	/* do not disclose kernel pointers */
+		eval = copyout(&sbuf, real_arg.buf,
 			       sizeof(struct semid_ds));
 		rval = IXSEQ_TO_IPCID(semid, semaptr->ds.sem_perm);
 		break;