Subject: Re: A bunch of memory allocation bugs in CGD
To: None <firstname.lastname@example.org>
From: ALeine <email@example.com>
Date: 03/30/2005 10:29:53
> Thanks for having a look at that. I have checked in a fix.
Thanks for responding so quickly.
> I presume that you have addressed the cases in GBDE where
> malloc's return code has not been checked? If so, perhaps
> cvsweb is a little behind. It looks to me like 2 or 4 mallocs
> can use a buffer without checking the return code.
There are two malloc bugs in GBDE, but both are minor and have
no security implications. Both bugs are in src/sbin/gbde/gbde.c:
- the first bug is in cmd_nuke() and could not be seen as much
of a bug because cmd_nuke() is used to destroy lock sectors.
If this fails due to memory starvation no sensitive information
is leaked, only a write(2) call fails and gbde terminates
correctly upon catching and reporting the write error.
- the second bug is in cmd_write(), where a buffer is allocated
and checked, but not immediately, so there is a case where it
can be used before it gets checked. However, even if this happens,
only a read(2) call fails and gbde terminates correctly upon
catching and reporting the read error.
In src/sys/geom/bde/g_bde.c there is also a g_malloc() allocated buffer
which is unchecked, but since the allocation is done with the M_WAITOK
flag it's safe. This means there are no malloc bugs in GBDE which could
cause a segmentation violation.
I have sent the patch for the minor malloc bugs I described above to
Poul-Henning, so I expect him to review it and commit the appropriate
fix in the near future.
WebMail FREE http://mail.austrosearch.net