HomeFreeBSD

ktrace: Handle negative array sizes in ktrstructarray

Description

ktrace: Handle negative array sizes in ktrstructarray

ktrstructarray() may be used to create copies of kevent(2) change and
event arrays. It is called before parameter validation is done and so
should check for bogus array lengths before allocating a copy.

Reported by: syzkaller
Reviewed by: kib
Sponsored by: The FreeBSD Foundation

(cherry picked from commit f88510077377157008f648b7036e1d1c9c83ea23)

Details

Provenance
markjAuthored on May 27 2021, 7:49 PM
Parents
rG2fb377976493: ipfilter: Fix ip_nat memory leak and use-after-free
Branches
Unknown
Tags
Unknown