From d585d2c0fc122ef86335d29698e27066740d33fd Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Mon, 29 Dec 2003 05:41:51 -0800 Subject: [PATCH] [PATCH] fix unsigned issue with env_end - env_start From: Chris Wright Fix for CAN-2003-0462: A race condition in the way env_start and env_end pointers are initialized in the execve system call and used in fs/proc/base.c on Linux 2.4 allows local users to cause a denial of service (crash). --- fs/proc/base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 9da127ff6c4ff..25eec04118047 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -282,7 +282,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer) int res = 0; struct mm_struct *mm = get_task_mm(task); if (mm) { - int len = mm->env_end - mm->env_start; + unsigned int len = mm->env_end - mm->env_start; if (len > PAGE_SIZE) len = PAGE_SIZE; res = access_process_vm(task, mm->env_start, buffer, len, 0); @@ -294,7 +294,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer) static int proc_pid_cmdline(struct task_struct *task, char * buffer) { int res = 0; - int len; + unsigned int len; struct mm_struct *mm = get_task_mm(task); if (!mm) goto out; -- 2.53.0