[7406] in bugtraq
Re: Fwd: Any user can panic OpenBSD machine
daemon@ATHENA.MIT.EDU (Todd C. Miller)
Mon Jul 27 22:00:21 1998
Date: Mon, 27 Jul 1998 14:59:55 -0600
Reply-To: "Todd C. Miller" <Todd.Miller@COURTESAN.COM>
From: "Todd C. Miller" <Todd.Miller@COURTESAN.COM>
X-To: Dag-Erling Coidan =?iso-8859-1?Q?Sm=F8rgrav?=
<dag-erli@ifi.uio.no>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: Your message of "27 Jul 1998 22:55:49 +0200."
<xzphg0357ze.fsf@hrotti.ifi.uio.no>
In message <xzphg0357ze.fsf@hrotti.ifi.uio.no>
so spake (dag-erli):
> /sys/kern/sys_generic.c:
> if (uap->iovcnt > UIO_MAXIOV)
> return (EINVAL);
>
> /sys/sys/uio.h:
> #define UIO_MAXIOV 1024 /* max 1K of iov's */
>
> -1 is rejected with EINVAL because 4294967295 > 1024.
>
> BTW, FreeBSD is immune, too. As a matter of fact, the original BSD
> version (SCCS ID "@(#)sys_generic.c 8.5 (Berkeley) 1/21/94") has the
> check, so the OpenBSD folks must have f*d it up somewhere along the
> way.
>
> DES (aka des@freebsd.org)
> --
> Dag-Erling Sm=F8rgrav - dag-erli@ifi.uio.no
We are talking about uio_resid not uio_iovcnt.
- todd
