[src/trunk]: src/sys/kern reject attempts to write CTLTYPE_BOOL nodes with a ...

[mrg <mrg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/57563900f217
branches:  trunk
changeset: 753812:57563900f217
user:      mrg <mrg%NetBSD.org@localhost>
date:      Sun Apr 11 01:50:25 2010 +0000

description:
reject attempts to write CTLTYPE_BOOL nodes with a value other than 0 or 1.

diffstat:

 sys/kern/kern_sysctl.c |  8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diffs (36 lines):

diff -r 0796141eb88e -r 57563900f217 sys/kern/kern_sysctl.c
--- a/sys/kern/kern_sysctl.c    Sun Apr 11 01:12:28 2010 +0000
+++ b/sys/kern/kern_sysctl.c    Sun Apr 11 01:50:25 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_sysctl.c,v 1.228 2010/01/13 01:53:38 pooka Exp $  */
+/*     $NetBSD: kern_sysctl.c,v 1.229 2010/04/11 01:50:25 mrg Exp $    */
 
 /*-
  * Copyright (c) 2003, 2007, 2008 The NetBSD Foundation, Inc.
@@ -68,7 +68,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.228 2010/01/13 01:53:38 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_sysctl.c,v 1.229 2010/04/11 01:50:25 mrg Exp $");
 
 #include "opt_defcorename.h"
 #include "ksyms.h"
@@ -1522,7 +1522,7 @@
        sz = rnode->sysctl_size;
        switch (SYSCTL_TYPE(rnode->sysctl_flags)) {
        case CTLTYPE_BOOL: {
-               u_char tmp;
+               bool tmp;
                /*
                 * these data must be *exactly* the same size coming
                 * in.  bool may only be true or false.
@@ -1530,6 +1530,8 @@
                if (newlen != sz)
                        return (EINVAL);
                error = sysctl_copyin(l, newp, &tmp, sz);
+               if (tmp != true && tmp != false)
+                       return EINVAL;
                if (error)
                        break;
                *(bool *)d = tmp;