Skip to content

Commit a82a5c6

Browse files
committed
fix for CVE-2026-45253 from freebsd
FreeBSD-SA-26:21.ptrace Does not include test changes
1 parent 4140bdf commit a82a5c6

1 file changed

Lines changed: 10 additions & 7 deletions

File tree

sys/kern/kern_sig.c

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2578,23 +2578,26 @@ ptrace_syscallreq(struct thread *td, struct proc *p,
25782578
struct sysentvec *sv;
25792579
struct sysent *se;
25802580
register_t rv_saved[2];
2581+
unsigned int sc;
25812582
int error, nerror;
2582-
int sc;
25832583
bool audited, sy_thr_static;
25842584

2585-
sv = p->p_sysent;
2586-
if (sv->sv_table == NULL || sv->sv_size < tsr->ts_sa.code) {
2587-
tsr->ts_ret.sr_error = ENOSYS;
2588-
return;
2589-
}
2590-
25912585
sc = tsr->ts_sa.code;
25922586
if (sc == SYS_syscall || sc == SYS___syscall) {
2587+
if (tsr->ts_nargs == 0) {
2588+
tsr->ts_ret.sr_error = EINVAL;
2589+
return;
2590+
}
25932591
sc = tsr->ts_sa.args[0];
25942592
memmove(&tsr->ts_sa.args[0], &tsr->ts_sa.args[1],
25952593
sizeof(register_t) * (tsr->ts_nargs - 1));
25962594
}
25972595

2596+
sv = p->p_sysent;
2597+
if (sv->sv_table == NULL || sc >= sv->sv_size) {
2598+
tsr->ts_ret.sr_error = ENOSYS;
2599+
return;
2600+
}
25982601
tsr->ts_sa.callp = se = &sv->sv_table[sc];
25992602

26002603
VM_CNT_INC(v_syscall);

0 commit comments

Comments
 (0)