Bug Hunter Diary

1094 return (ENXIO);1095 if (t != tp->t_line) {1096 s = spltty();1097 (*linesw[tp->t_line].l_close)(tp, flag);1098 error = (*linesw[t].l_open)(device, tp);1099 if (error) {1100 (void)(*linesw[tp->t_line].l_open)(device, tp);1101 splx(s);1102 return (error);1103 }1104 tp->t_line = t;1105 splx(s);1106 }1107 break;1108 }[..]If a TIOCSETD IOCTL request is sent to the kernel, the switch casein line 1089 is chosen. In line 1090, the user-supplied data of typecaddr_t, which is simply a typedef for char *, is stored in the signed intvariable t. Then in line 1093, the value of t is compared with nlinesw.Since data is supplied by the user, it’s possible to provide a stringvalue that corresponds to the unsigned integer value of 0x80000000 orgreater. If this is done, t will have a negative value due to the type conversionin line 1090. Listing 7-1 illustrates how t can become negative:01 typedef char * caddr_t;0203 // output the bit pattern04 void05 bitpattern (int a)06 {07 int m = 0;08 int b = 0;09 int cnt = 0;10 int nbits = 0;11 unsigned int mask = 0;1213 nbits = 8 * sizeof (int);14 m = 0x1 = 1;23 }24 printf ("\n");25 }2627 int28 main ()29 {A Bug Older Than 4.4BSD 117