From d6e44c36d8847b07f0a09507b58272b704f0b5e7 Mon Sep 17 00:00:00 2001 From: gordon Date: Tue, 28 Jan 2020 18:54:15 +0000 Subject: [PATCH] Fix nmount invalid pointer dereference Submitted by: Andrew Turner Approved by: so Security: FreeBSD-EN-20:02.nmount --- sys/kern/vfs_mount.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index e841e8a40ac..c176faf886a 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -591,7 +591,7 @@ vfs_donmount(struct thread *td, uint64_t fsflags, struct uio *fsoptions) */ fstypelen = 0; error = vfs_getopt(optlist, "fstype", (void **)&fstype, &fstypelen); - if (error || fstype[fstypelen - 1] != '\0') { + if (error || fstypelen <= 0 || fstype[fstypelen - 1] != '\0') { error = EINVAL; if (errmsg != NULL) strncpy(errmsg, "Invalid fstype", errmsg_len); @@ -599,7 +599,7 @@ vfs_donmount(struct thread *td, uint64_t fsflags, struct uio *fsoptions) } fspathlen = 0; error = vfs_getopt(optlist, "fspath", (void **)&fspath, &fspathlen); - if (error || fspath[fspathlen - 1] != '\0') { + if (error || fspathlen <= 0 || fspath[fspathlen - 1] != '\0') { error = EINVAL; if (errmsg != NULL) strncpy(errmsg, "Invalid fspath", errmsg_len); -- 2.45.0