⬢ DragonFlyBSD Kernel Audit
DF-5710 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
--- a/sys/vfs/smbfs/smbfs_vfsops.c
+++ b/sys/vfs/smbfs/smbfs_vfsops.c
@@ -167,13 +167,21 @@
 	bzero(pc, MNAMELEN);
 	*pc++ = '/';
 	*pc++ = '/';
-	pc=index(strncpy(pc, vcp->vc_username, pe - pc - 2), 0);
-	if (pc < pe-1) {
-		*(pc++) = '@';
-		pc = index(strncpy(pc, vcp->vc_srvname, pe - pc - 2), 0);
-		if (pc < pe - 1) {
-			*(pc++) = '/';
-			strncpy(pc, ssp->ss_name, pe - pc - 2);
+	/*
+	 * Require room for at least one payload byte plus the NUL that
+	 * strncpy() is not guaranteed to write: "pe - pc - 2" must never
+	 * be negative, or strncpy() receives (size_t)-1 and copies
+	 * unboundedly (kernel heap corruption past f_mntfromname).
+	 */
+	if (pe - pc > 2) {
+		pc = index(strncpy(pc, vcp->vc_username, pe - pc - 2), 0);
+		if (pe - pc > 2) {
+			*(pc++) = '@';
+			pc = index(strncpy(pc, vcp->vc_srvname, pe - pc - 2), 0);
+			if (pe - pc > 2) {
+				*(pc++) = '/';
+				strncpy(pc, ssp->ss_name, pe - pc - 2);
+			}
 		}
 	}
 	/* protect against invalid mount points */