NetBSD Problem Report #50413

From www@NetBSD.org  Sun Nov  8 15:59:04 2015
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id B5D80A6558
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  8 Nov 2015 15:59:04 +0000 (UTC)
Message-Id: <20151108155900.D33FAA65BE@mollari.NetBSD.org>
Date: Sun,  8 Nov 2015 15:59:00 +0000 (UTC)
From: vchaves@ymail.com
Reply-To: vchaves@ymail.com
To: gnats-bugs@NetBSD.org
Subject: the vcons_putwschar function does not check for invalid values going through ioctl
X-Send-Pr-Version: www-1.0

>Number:         50413
>Category:       kern
>Synopsis:       the vcons_putwschar function does not check for invalid values going through ioctl
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 08 16:00:00 +0000 2015
>Last-Modified:  Sun Nov 08 16:50:00 +0000 2015
>Originator:     Vicente Chaves
>Release:        netbsd-current
>Organization:
>Environment:
NetBSD nb7.vbox.lab 7.99.21 NetBSD 7.99.21 (GENERIC) #0: Thu Nov  5 18:32:03 UTC 2015  vchaves@netbsd7.vbox.lab:/home/vchaves/current/build/sys/arch/amd64/compile/GENERIC amd64
>Description:
Even when wsc->flags parameter from userland, through ioctl, contains invalid attributes, the vcons_putwschar() function does not check the function return ri->riops.allocattr() and passes the variable attr
directly to the vcons_putchar() function with a value of undefined.
>How-To-Repeat:
Use the wsmoused when the display is using driver genfb
>Fix:
nb7# cvs diff -u sys/dev/wscons/
cvs diff: Diffing .
cvs diff: Diffing sys
cvs diff: Diffing sys/dev
cvs diff: Diffing sys/dev/wscons
Index: sys/dev/wscons/wsdisplay_vcons.c
===================================================================
RCS file: /cvsroot/src/sys/dev/wscons/wsdisplay_vcons.c,v
retrieving revision 1.34
diff -u -r1.34 wsdisplay_vcons.c
--- sys/dev/wscons/wsdisplay_vcons.c    19 Jul 2015 13:22:42 -0000      1.34
+++ sys/dev/wscons/wsdisplay_vcons.c    8 Nov 2015 15:51:31 -0000
@@ -1140,6 +1140,7 @@
 {
        long attr;
        struct rasops_info *ri;
+       int error;

        KASSERT(scr != NULL && wsc != NULL);

@@ -1152,8 +1153,12 @@
        if ((wsc->row >= 0) && (wsc->row < ri->ri_rows) && (wsc->col >= 0) &&
             (wsc->col < ri->ri_cols)) {

-               ri->ri_ops.allocattr(ri, wsc->foreground, wsc->background,
+               error = ri->ri_ops.allocattr(ri, wsc->foreground, wsc->background,
                    wsc->flags, &attr);
+
+                if (error)
+                    return error;
+
                vcons_putchar(ri, wsc->row, wsc->col, wsc->letter, attr);
 #ifdef VCONS_DEBUG
                printf("vcons_putwschar(%d, %d, %x, %lx\n", wsc->row, wsc->col,

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/50413 CVS commit: src/sys/dev/wscons
Date: Sun, 8 Nov 2015 11:49:21 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Sun Nov  8 16:49:21 UTC 2015

 Modified Files:
 	src/sys/dev/wscons: wsdisplay_vcons.c

 Log Message:
 PR/50413: Vicente Chaves: Check the allocattr return and return an error.


 To generate a diff of this commit:
 cvs rdiff -u -r1.34 -r1.35 src/sys/dev/wscons/wsdisplay_vcons.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search