[src/trunk]: src/sys/kern copyinargs: Plug theoretical memory leak when fakea...

[uebayasi <uebayasi%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/41e34bf3f671
branches:  trunk
changeset: 795598:41e34bf3f671
user:      uebayasi <uebayasi%NetBSD.org@localhost>
date:      Sat Apr 19 22:59:08 2014 +0000

description:
copyinargs: Plug theoretical memory leak when fakearg is too long.

Pointed out & reviewed by Maxime Villard.

diffstat:

 sys/kern/kern_exec.c |  14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)

diffs (36 lines):

diff -r 147a84e11770 -r 41e34bf3f671 sys/kern/kern_exec.c
--- a/sys/kern/kern_exec.c      Sat Apr 19 21:21:24 2014 +0000
+++ b/sys/kern/kern_exec.c      Sat Apr 19 22:59:08 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_exec.c,v 1.403 2014/04/18 11:44:31 maxv Exp $     */
+/*     $NetBSD: kern_exec.c,v 1.404 2014/04/19 22:59:08 uebayasi Exp $ */
 
 /*-
  * Copyright (c) 2008 The NetBSD Foundation, Inc.
@@ -59,7 +59,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.403 2014/04/18 11:44:31 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_exec.c,v 1.404 2014/04/19 22:59:08 uebayasi Exp $");
 
 #include "opt_exec.h"
 #include "opt_execfmt.h"
@@ -1468,8 +1468,16 @@
                        /* Count NUL into len. */
                        if (len < maxlen)
                                len++;
-                       else
+                       else {
+                               while (tmpfap->fa_arg != NULL) {
+                                       kmem_free(tmpfap->fa_arg,
+                                           tmpfap->fa_len);
+                                       tmpfap++;
+                               }
+                               kmem_free(epp->ep_fa, epp->ep_fa_len);
+                               epp->ep_flags &= ~EXEC_HASARGL;
                                return E2BIG;
+                       }
                        ktrexecarg(tmpfap->fa_arg, len - 1);
                        dp += len;